Self-test for analgesic product

ABSTRACT

Electrotransport drug delivery devices, system and methods of using configured to determine if a current is present between the anode and cathode when drug is not intended to be delivered by the device. These devices/systems may include an off-current module to determine that any current (e.g., which may be inferred by measuring potential difference between the anode and cathode of the device) flowing between the anode and cathode is below a threshold value when the device is not supposed to be delivering drug, thereby preventing unintended delivery of drug and/or alerting a user that unintended delivery of drug may occur.

CROSS REFERENCE TO RELATED APPLICATIONS

This application is a continuation of U.S. patent application Ser. No.13/866,371, filed Apr. 19, 2013, titled “SELF-TEST FOR ANALGESICPRODUCT,” now U.S. Pat. No. 9,095,706, which is a divisional of U.S.patent application Ser. No. 13/476,960, filed May 21, 2012, titled“SELF-TEST FOR ANALGESIC PRODUCT,” now U.S. Pat. No. 8,428,708, each ofwhich is herein incorporated by reference in its entirety.

INCORPORATION BY REFERENCE

All publications and patent applications mentioned in this specificationare herein incorporated by reference in their entirety to the sameextent as if each individual publication or patent application wasspecifically and individually indicated to be incorporated by reference.

FIELD

The present invention relates generally to electrotransport drugdelivery devices and methods of operation and use. These drug deliverydevices may have improved safety. In particular, the invention isdirected to drug delivery devices including automated self-testing.

BACKGROUND

A variety of drug delivery systems, including automatic drug deliverysystems, are known. Because the consequences of delivering aninappropriate dosage (e.g., too much or too little) of a drug can belife threatening, it is of critical importance that drug deliverysystems be extremely accurate. Drug delivery systems that are configuredto deliver medication to patients must be configured to prevent evenunlikely accidental delivery events. In particular, drug deliverysystems that electrically deliver drug to a patient, includingtransdermal or other electroransport drug delivery devices, shouldideally prevent accidentally providing drug to the patient.

The term “electrotransport” as used herein refers generally to thedelivery of an agent (e.g., a drug) through a biological membrane, suchas skin, mucous membrane, or nails. The delivery is induced or aided byapplication of an electrical potential. For example, a beneficialtherapeutic agent may be introduced into the systemic circulation of ahuman body by electrotransport delivery through the skin. A widely usedelectrotransport process, electromigration (also called iontophoresis),involves the electrically induced transport of charged ions. Anothertype of electrotransport, electro-osmosis, involves the flow of aliquid. The liquid contains the agent to be delivered, under theinfluence of an electric field. Still another type of electrotransportprocess, electroporation, involves the formation of transiently-existingpores in a biological membrane by the application of an electric field.An agent can be delivered through the pores either passively (i.e.,without electrical assistance) or actively (i.e., under the influence ofan electric potential). However, in any given electrotransport process,more than one of these processes may be occurring simultaneously to acertain extent. Accordingly, the term “electrotransport”, as usedherein, should be given its broadest possible interpretation so that itincludes the electrically induced or enhanced transport of at least oneagent, which may be charged, uncharged, or a mixture thereof, regardlessof the specific mechanism or mechanisms by which the agent istransported.

In general, electrotransport devices use at least two electrodes thatare in electrical contact with some portion of the skin, nails, mucousmembrane, or other body surface. One electrode, commonly called the“donor” or “active” electrode, is the electrode from which the agent isdelivered into the body. The other electrode, typically termed the“counter” or “return” electrode, serves to close the electrical circuitthrough the body. For example, if the agent to be delivered ispositively charged, i.e., a cation, then the anode is the active ordonor electrode, while the cathode serves to complete the circuit.Alternatively, if an agent is negatively charged, i.e., an anion, thecathode is the donor electrode. Additionally, both the anode and cathodemay be considered donor electrodes if both anionic and cationic agentions, or if uncharged dissolved agents, are to be delivered.

Furthermore, electrotransport delivery systems generally require atleast one reservoir or source of the agent to be delivered to the body.Examples of such donor reservoirs include a pouch or cavity, a poroussponge or pad, and a hydrophilic polymer or a gel matrix. Such donorreservoirs are electrically connected to, and positioned between, theanode or cathode and the body surface, to provide a fixed or renewablesource of one or more agents or drugs. Electrotransport devices alsohave an electrical power source such as one or more batteries.Typically, one pole of the power source is electrically connected to thedonor electrode, while the opposite pole is electrically connected tothe counter electrode. In addition, some electrotransport devices havean electrical controller that controls the current applied through theelectrodes, thereby regulating the rate of agent delivery. Passive fluxcontrol membranes, adhesives for maintaining device contact with a bodysurface, insulating members, and impermeable backing members are someother potential components of an electrotransport device that may beused.

Small, self-contained electrotransport drug delivery devices adapted tobe worn on the skin for extended periods of time have been proposed.See, e.g., U.S. Pat. No. 6,171,294, U.S. Pat. No. 6,881,208, U.S. Pat.No. 5,843,014, U.S. Pat. No. 6,181,963, U.S. Pat. No. 7,027,859, U.S.Pat. No. 6,975,902, and U.S. Pat. No. 6,216,033. These electrotransportagent delivery devices typically utilize an electrical circuit toelectrically connect the power source (e.g., a battery) and theelectrodes. The electrical components in such miniaturized iontophoreticdrug delivery devices are also preferably miniaturized, and may be inthe form of either integrated circuits (i.e., microchips) or smallprinted circuits. Electronic components, such as batteries, resistors,pulse generators, capacitors, etc., are electrically connected to forman electronic circuit that controls the amplitude, polarity, timingwaveform shape, etc., of the electric current supplied by the powersource. Other examples of small, self-contained electrotransportdelivery devices are disclosed in U.S. Pat. No. 5,224,927; U.S. Pat. No.5,203,768; U.S. Pat. No. 5,224,928; and U.S. Pat. No. 5,246,418.

One concern, particularly with small self-contained electrotransportdelivery devices which are manufactured with the drug to be deliveredalready in them, is the potential for unintended delivery of drugbecause of electrical energy applied from an outside source, or becauseof an internal short. Any current or potential difference between theanode and cathode of the device may result in delivery of drug by adevice contacting the skin, even if the device is not activated or in anoff state. For example, drug may unintentionally be delivered if acurrent is applied through the devices or to a subject wearing a device,even if the device is in an off mode (even powered off). This risk,while hopefully unlikely, has not previously been addressed byelectrotransport drug delivery devices.

Although an electrotransport device may include control circuitry and/ormodules (e.g., software, firmware, hardware, etc.) configuredspecifically to regulate the current (and therefore the dosage of drug)applied when the device is “on,” such devices do not typically monitorthe devices when they are in an “off” state.

Described herein are methods, devices and systems for monitoring andcontrolling electrotransport drug delivery devices to detect and/orprevent delivery of drug by the device when it is in an off mode orstate. In particular, described herein are devices, systems and methodsthat confirm that voltage or current is not applied between theelectrodes (anode and cathode) of the device when it is in an “off”state or mode.

SUMMARY OF THE DISCLOSURE

In general, described herein are devices and methods includingself-testing to prevent delivery of drug from an electrotransport drugdelivery device when the device is not activated or in an off state.

For example, described herein are electrotransport drug delivery devicesthat prevent unwanted delivery of drug while in an off state. The devicemay include: an anode; a cathode; an activation circuit configured toapply current between the anode and cathode to deliver a drug byelectrotransport when the device is in an on state and not in the offstate; and an off-current module that is configured to automatically andperiodically determine if there is a current flowing between the anodeand cathode when the activation circuit is in the off state whilepowered on.

In general, the anode and/or cathode may connect to a source of the drugto be delivered, such as an analgesic like fentanyl and sufantanilwithin a gel matrix. The device may include a controller/processor orother electronic components (including software, hardware and/orfirmware) forming the activation circuit and/or off-current module. Insome variations the off-current module is integrated with other controlsystems (sub-systems) forming the device.

As used herein, a module, such as the off-current module, may includehardware, software, and/or firmware configured to perform the specifiedfunction (e.g., determine if a current is flowing between the anode andcathode). The module may include a combination of these, and may be aseparate or separable region of the device or it may make use of sharedcomponents of the device (e.g., a microcontroller, resistive elements,etc.). For example, an off-current module comprises firmware, softwareand/or hardware configured to determine if there is a potentialdifference between the anode and the cathode when the activation circuitis in the off state while powered on. A module, such as the off-currentmodule may include executable logic that operates on elements (e.g., amicrocontroller) of the device. For example, the off-current module mayinclude off-current monitoring logic controlling monitoring for thepresence of a current (or indicator of current such as electricalpotential, inductive or capacitive changes, etc.) between the anode andcathode when the device is otherwise in an off state.

In some variations of the device, systems and methods described hereinthe off-current module operates to monitor for and/or act uponidentifying a current between the anode and cathode when the device ispowered on but in an off state. Examples of off-states are providedbelow, but may include a ready state, a standby state, or the like, andmay include any state during which the device is not in a dosing stateand is not intended to deliver drug. The dosing state may be referred toas an on state and may indicate that the device is delivering drug. Theoff state described herein may occur when the device is otherwisepowered on. In some variations, the off state includes the powered offstate, while in some variations the off state does not include thepowered off state, but only includes off states when the device ispowered on.

In general, the off-current module may be configured to detect currentflow between the anode and cathode in an off state either directly orindirectly. For example, in some variations the off-current moduledetermines that current is flowing between the anode and cathode bymonitoring for a voltage or a potential difference between the anode andcathode in the off state. For example, in some variations, theoff-current module comprises software, firmware and/or hardwareconfigured to determine if there is a change in capacitance between theanode and cathode when the activation circuit is in the off state whilepowered on. In one example an off-current module comprises software,firmware and/or hardware configured to determine if there is a change ininductance between the anode and cathode when the activation circuit isin the off state while powered on. Thus, current may be inferred to beflowing between the anode and cathode by monitoring indirectly forpresence of or changes in potential difference (e.g., voltage),capacitance, inductance, or the like, between the anode and cathode ofthe device.

In general, the off-current module may indicate that current is flowingbetween the anode and cathode only when the detected current (or anindicator of current such as potential difference, inductance,capacitance, etc.) is above a threshold value. The threshold value istypically above the noise threshold for the device/system. Thisthreshold may be predetermined. For example, in some variations theoff-current module may comprise a sensing circuit that independentlydetermines an anode voltage and a cathode voltage and compares thepotential difference between the anode voltage and cathode voltage to athreshold value. For example, an off-current module may be configured toindicate that there is a current flowing between the anode and cathodewhen the activation circuit is in the off state while powered on wherethe current flowing is above an Output Current Off Threshold. Anyappropriate Output Current Off Threshold may be used, e.g., about 1 μA,3 μA, 5 μA, 9 μA, 10 μA, 15 μA, 25 μA, 30 μA, 50 μA, 100 μA, etc. Insome variations the Output Current Off Threshold is about 9 μA.

An electrotransport device may include a switch connected between areference voltage source and a sense resistor, so that the off-currentmodule is configured to close the switch periodically to determine thepotential difference between the anode voltage and cathode voltage.

Thus, in some variations the off-current module may be configured todetermine if there is a potential difference between the anode and thecathode before the device allows current to travel through the anode andcathode. For example, the off-current module, be detecting if there is acurrent flowing between the anode and cathode even when the device isotherwise “off”, may trigger an alert that there is a leak current. Insome variations the alert may include a shutdown of the device, and/or avisible (e.g., indicator light) or audible (e.g., beeping, buzzing,etc.) notification.

The off-current module may be configured to monitor at any periodicand/or automatic interval. For example, the off-current module may beconfigured to determine if there is a current flowing between the anodeand cathode when the activation circuit is in the off state at leastonce per minute, once per 10 ms, once per 100 ms, once per 500 ms, onceper 1 min, once per 2 min, once per 3 min, once per 4 min, once per 5min, once per 10 min, once per 15 min, etc. For example, the off-currentmodule may be configured to determine if there is a current flowingbetween the anode and cathode when the activation circuit is in the offstate between at least once every 10 ms and once every 10 minutes.

In some variations an off-current module may be configured to wait somelength of time (e.g., at least 10 ms) before determining if there is acurrent flowing between the anode and cathode when the activationcircuit is in the off state. This length of time may be at least 4 ms,at least 10 ms, at least 15 ms, at least 30 ms, etc.

In some variations the electrotransport devices described herein have atwo-part structure. The two-part structure may include: an electricalmodule including the activation circuit and the off-current module; anda reservoir module including the anode and the cathode and a source ofdrug to be delivered; wherein the electrical module and reservoir moduleare configured to be combined prior to application to a patient. In somevariations, the off-current module may not be enabled until theelectrical module and reservoir module are combined.

As mentioned above, in some variations, the off-current module may beconfigured to indicate that there is a current flowing between the anodeand cathode when the activation circuit is in the off state whilepowered on, where the current flowing is above an Output Current OffThreshold. For example, the Output Current Off Threshold may be about 9μA.

Also described herein are electrotransport drug delivery devices thatprevent unwanted delivery of drug while in an off state. The device mayinclude: a reservoir module including: an anode, a cathode and a sourceof drug; an electrical module including: an activation circuitconfigured to apply current between the anode and cathode to deliver adrug by electrotransport when the device is in an on state and not inthe off state; and an off-current module, the module configured toautomatically and periodically determine if there is a current flowingbetween the anode and the cathode greater than an Output Current OffThreshold of 9 μA when the activation circuit is in the off state whilepowered on; wherein the reservoir module and the electrical module areconfigured to be combined before being applied to a patient.

Methods of automatically and periodically confirming that drug will notbe delivered by an electrotransport drug delivery device when the deviceis in an off state are also described herein. For example, a method ofautomatically and periodically confirming that drug will not bedelivered by an electrotransport drug delivery device when the device isin an off state while powered on may include the steps of: determiningif there is a current flowing between an anode and a cathode of theelectrotransport drug delivery device when the electrotransport drugdelivery device is in an off state while powered on, wherein theelectrotransport drug delivery device includes an activation circuitthat is configured to apply current between the anode and the cathode todeliver a drug when the device is in an on state and not in the offstate; and triggering an indicator if there is a current flowing betweenthe anode and cathode that is greater than an Output Current OffThreshold when the electrotransport drug delivery device is in an offstate while powered on. The method may also include repeating thedetermining step periodically while the activation circuit is in an offstate. In some variations the method also includes repeating thedetermining step at least once every 10 minutes while the activationcircuit is in an off state and the device is powered on.

As mentioned above, any appropriate Output Current Off Threshold may beused. For example, an Output Current Off Threshold may be about 9 μA.The step of determining if there is a current flowing between the anodeand cathode of the electrotransport drug delivery device may includeindependently determining an anode voltage and a cathode voltage andcomparing the potential difference between the anode voltage and cathodevoltage to the threshold value. Any appropriate threshold (e.g., abovenoise) value may be used. For example, a threshold value may be about2.5 V. In some variations the threshold value is about 0.85 V.

In some variations, the step of determining if there is a currentflowing between the anode and cathode of the electrotransport drugdelivery device may include independently connecting a reference voltagesource and a sense resistor with each of the anode and cathode todetermine the potential difference between the anode voltage and cathodevoltage.

Any of the methods described herein may also include activating theactivation circuit to enter the on state and applying current betweenthe anode and the cathode after determining that no current above theOutput Current Off Threshold is flowing between the anode and cathodewhile the electrotransport drug delivery device is in the off state.

In any of the devices, systems and methods described herein, theelectrotransport device may trigger an indicator and/or modify the stateof the device when a current is detected or inferred, between the anodeand cathode while the device is in the off state. For example, in somevariations, the device may trigger an indicator comprising a visible,audible and/or tactile alert or alarm. For example, an indicator mayinclude illuminating a light and/or sounding an alarm on the device. Insome variations, the system may transmit (e.g., electronically,wirelessly, etc.) a signal to another device such as a computer,handheld device, server, and/or monitoring station indicating the alarmstatus of the device.

In any of the variations described herein, the device, system or methodmay be configured so that when the off-current module senses or infers acurrent is flowing between the anode and cathode while the device is inthe off state (e.g., while the device is otherwise powered on), thetriggering of an indicator may include switching the device to an end oflife state, e.g., such as performing a device shutdown. Thus, when theoff-current module determines or infers that current is flowing betweenthe anode and cathode when the device is not supposed to be deliveringdrug, the device (e.g., the off-current module) may prevent furtherunwanted drug delivery.

In general, when the device or system (or methods of operating them) isdescribed as detecting current flowing between the anode and cathode ofthe device when the device is not supposed to be delivering drug (e.g.,when an off-current module detects current flow between the anode andcathode in an off state) this may be interpreted in some variations asdetermining if there is a current above some threshold flowing betweenthe anode and cathode. As described above, depending on the way in whichthe off-current module detects or infers current flow between the anodeand cathode, this threshold may be a current threshold, a potentialdifference (i.e., voltage) threshold, an inductive threshold, acapacitive threshold, or the like. The threshold may be predetermined(preset) in the device.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1A is a block diagram of an exemplary potential differencedetection system including a controller, an electrotransport drugdelivery circuit, a sensing circuit, an anode and a cathode.

FIG. 1B is a flow diagram of a method of an exemplary automatedself-test of an electrotransport drug delivery system configured as anoff-current (or anode/cathode voltage difference) test.

FIG. 2A illustrates an exemplary therapeutic agent delivery system intwo parts.

FIG. 2B shows the exemplary system of FIG. 1 combined to form a single,unitary device.

FIG. 3 shows an exploded perspective view of a two-part device.

FIG. 4 shows an exploded perspective view of an exemplary reservoirmodule.

FIG. 5 is a cross-section perspective view of a reservoir contact.

FIG. 6 shows a bottom view of an electrical module and a top view of areservoir module.

FIGS. 7A and 7B show cross-section views of a power-on connector whenopen (prior to actuation) and closed by a power-on post acting through apower-on receptacle.

FIG. 8 shows a cross-section view of an output from the electricalmodule making contact with an input connector on the reservoir module.

FIG. 9 is a circuit diagram for electronics within an electrical moduleof the device described herein.

FIG. 10 is a flow chart showing a power-on sequence of a device asdescribed herein.

FIG. 11 is a second flow chart showing an alternative power-on sequenceof a device as described herein.

FIG. 12 is a diagram showing the user mode diagram for one exemplaryembodiment of a system including an off-current self-test module.

FIG. 13 shows an example of a software block diagram for the example ofFIG. 12.

FIG. 14 illustrates one variation a procedure for system initialization.

FIG. 15 shows a software state chart for the Example of FIG. 12.

FIG. 16 is an exemplary diagram of a current control circuit for onevariation of a drug delivery device.

FIG. 17 shows a Dosing Mode Flow Diagram.

FIG. 18 shows a Dose Initiation Flow Diagram.

FIG. 19 shows a Dose Control Flow Diagram.

FIG. 20 shows a Dose Completion Flow Diagram.

FIG. 21 shows Table 1, indicating one variation of the sequencing ofself-testing (the mode diagram of FIG. 12 may correspond with thistable).

DETAILED DESCRIPTION

Reference will now be made in detail to exemplary embodiments of theinvention, examples of which are illustrated in the accompanyingdrawings. While the invention will be described in conjunction with theexemplary embodiments, it will be understood that they are not intendedto limit the invention to those embodiments. On the contrary, theinvention is intended to cover alternatives, modifications andequivalents, which may be included within the spirit and scope of theinvention as defined by the appended claims.

One method for transdermal delivery of active agents involves the use ofelectrical current to actively transport the active agent into the bodythrough intact skin by electrotransport. Electrotransport techniques mayinclude iontophoresis, electroosmosis, and electroporation.Electrotransport devices, such as iontophoretic devices are known in theart. One electrode, which may be referred to as the active or donorelectrode, is the electrode from which the active agent is deliveredinto the body. The other electrode, which may be referred to as thecounter or return electrode, serves to close the electrical circuitthrough the body. In conjunction with the patient's body tissue, e.g.,skin, the circuit is completed by connection of the electrodes to asource of electrical energy, and usually to circuitry capable ofcontrolling the current passing through the device when the device is“on” and delivering current. If the substance to be driven into the bodyis ionic and is positively charged, then the positive electrode (theanode) will be the active electrode and the negative electrode (thecathode) will serve as the counter electrode. If the ionic substance tobe delivered is negatively charged, then the cathodic electrode will bethe active electrode and the anodic electrode will be the counterelectrode.

A switch-operated therapeutic agent delivery device can provide singleor multiple doses of a therapeutic agent to a patient by activating aswitch. Upon activation, such a device delivers a therapeutic agent to apatient. A patient-controlled device offers the patient the ability toself-administer a therapeutic agent as the need arises. For example, thetherapeutic agent can be an analgesic agent that a patient canadminister whenever sufficient pain is felt.

As described in greater detail below, any appropriate drug (or drugs)may be delivered by the devices described herein. For example, the drugmay be an analgesic such as fentanyl (e.g., fentanyl HCL) or sufantanil.

In some variations, the different parts of the electrotransport systemare stored separately and connected together for use. For example,examples of electrotransport devices having parts being connectedtogether before use include those described in U.S. Pat. No. 5,320,597(Sage, Jr. et al); U.S. Pat. No. 4,731,926 (Sibalis), U.S. Pat. No.5,358,483 (Sibalis), U.S. Pat. No. 5,135,479 (Sibalis et al.), UK PatentPublication GB2239803 (Devane et al), U.S. Pat. No. 5,919,155 (Lattin etal.), U.S. Pat. No. 5,445,609 (Lattin et al.), U.S. Pat. No. 5,603,693(Frenkel et al.), WO 1996036394 (Lattin et al.), and US 2008/0234628 A1(Dent et al.).

In general, the systems and devices described herein include an anodeand cathode for the electrotransport of a drug or drugs into the patient(e.g., through the skin or other membrane) and a controller forcontrolling the delivery (e.g., turning the delivery on or off); all ofthe variations described herein may also include an off-current modulefor monitoring the anode and cathode when the activation circuit is inthe off state while still powered on to determine if there is apotential and/or current (above a threshold value) between the anode andcathode when the controller for device has otherwise turned the device“off” so that it should not be delivering drug to the patient. Thecontroller may include an activation controller (e.g., an activationmodule or activation circuitry) for regulating the when the device ison, applying current/voltage between the anode and cathode and therebydelivering drug.

Throughout this specification, unless otherwise indicated, singularforms “a”, “an” and “the” are intended to include plural referents.Thus, for example, reference to “a polymer” includes a single polymer aswell as a mixture of two or more different polymers, “a contact” mayrefer to plural contacts, “a post” may indicate plural posts, etc.

As used herein, the term “user” indicates anyone who uses the device,whether a healthcare professional, a patient, or other individual, withthe aim of delivering a therapeutic agent to a patient.

In general, the off-current module may include hardware, software,firmware, or some combination thereof (including control logic). Forexample, as illustrated in FIG. 1A, a system may include an anode,cathode and sensing circuit. The sensing circuit may form part (or beused by) the off-current module to sense any current between the anodeand cathode when the device is otherwise off. The device may alsoinclude a controller controlling operation of the device. The controllermay include a processor or ASIC that includes the off-current module.

In general, and off-current module may also be referred to as a type ofself-test that is performed by the device. In some variations, theoff-current module includes or is referred to as an anode/cathodevoltage difference test or off-current test, because in some variationsit may determine if there is a voltage difference between the anode andcathode when the device should be off.

FIG. 1B illustrates a simplified version of one method of performing ananode/cathode voltage difference test (also referred to as anoff-current test). Initially, when the device is powered on but it isnot activated to deliver drug (e.g., is in powered on but in an offstate), the device may periodically perform any number of self-testswhile in this “ready” mode. In particular, the device may perform theoff-current test to confirm that while the device is otherwise off,there is not a significant current flowing (which may be inferred, e.g.,by determining that there isn't a potential difference above a thresholdlevel sufficient to deliver drug to the patient) between the anode andcathode. In embodiments in which the current is determined by monitoringpotential difference, this potential difference may readily bedetermined by examining the difference between the voltage at the anodeand the voltage at the cathode. Any other subsystem or method ofmeasuring and/or inferring current flow between the anode and cathodemay also be used as long as the testing method itself does not result inundesirable drug delivery.

Returning to FIG. 1B, in the initial step 102 the self-test(s) such asthe off-current self-test may be periodically and automaticallyperformed while the device is in the ready mode. The off-currentself-test may be timed and executed by control logic (e.g., executing ona controller) which may be part of another controller or may be acontroller. In general the controller (or portion of a controller)performing the off-current test may be referred to as an off-currentmodule. The self-test may be triggered at regular intervals, such asevery 30 seconds, every minute, every two minutes, etc. Once theself-test is triggered, in some variations it may be performed bydetermining the difference between the voltage at the anode and thevoltage at the cathode in a manner that does not trigger release ofdrug. For example, the determination of the voltage of the anode may beisolated from the determination of the voltage of the cathode 104. Thedifference in the voltages may next be compared to a threshold value106, which may be referred to as the off-current threshold. Examples ofthis threshold value include 0.5V, 0.75V, 0.85V, 2.5V, etc. If thedifference is less than the threshold value than the device “passes” theself-test, and may continue in “ready” mode 110, or, if the activationof the device has been triggered (e.g., by pressing button), the devicemy begin delivering drug 112-116. Alternatively, if a leak current isdetected, e.g., when the voltage difference is greater than (or equalto) the threshold voltage (fail 122), the device may trigger an alertand/or may shut down to prevent unwanted delivery of drug.

Example 1 Two-Part System

Described below is one example of a two part system that may includeself-tests including in particular an anode/cathode voltage differencetest. For example, in some variations the devices including theoff-current self-test are configured as two-part electrotransporttherapeutic agent delivery devices, such as iontophoresis devices, inwhich the two parts of the device are provided separately and assembledto form a unitary, powered-on device at the point of use—that is to sayjust prior to use. In this example, one part of the device, which may bereferred to herein as the electrical module, holds essentially all ofthe circuitry, as well as the power source (e.g. battery), for thedevice; and the other part, which may be referred to herein as thereservoir module, contains the therapeutic agent to be delivered alongwith electrodes and hydrogels necessary to deliver the therapeutic agentto a patient. The device is configured such that the power source iskept electrically isolated from the rest of the circuitry in theelectrical module until the electrical module is combined with thereservoir module. Thus, embodiments provided herein permit thecombination of the electrical module and the reservoir module, wherebyin a single action the two modules form a single unit and the battery isintroduced into the circuitry, thereby powering on the device, in asingle action by the user.

As used herein, the term simultaneous, and grammatical variants thereof,indicates that two or more events occur at about the same time and/orthat they occur without any intervening step. For example, whenconnection of the modules occurs simultaneously with connection of thebattery into the circuit, the term “simultaneously” indicates that whenthe modules are connected, the battery is connected into the circuit atabout the same time, in a single action by the user, and that there isno additional step necessary on the part of the user to connect thebattery to the circuit. The term “substantially simultaneous” andgrammatical variants indicates that two events occur at about the sametime and no significant action is required by the user between the twoevents. For the sake of illustration only, such a significant actioncould be the activation of a separate switch (other than theherein-described power-on switches), removal of a tab, or other actionto connect the battery in the electrical module to the circuitry thereinupon connection of the two modules to one another.

Unless otherwise modified herein, the term “to break” and grammaticalvariants thereof refers to destroying or deforming something to thepoint that it is no longer operable for its intended purpose.

An electrotransport device may be assembled before use forelectrotransport delivery of ionic compounds (e.g., ionic drugs such asfentanyl and analogs, polypeptides, and the like) through a surface,such as skin. An electrotransport device may comprise a top or upperportion, herein referred to as an electrical module, and a bottom orlower portion, herein referred to as a reservoir module. The electricalmodule may contain circuitry (e.g. a printed circuit board), a powersource (e.g. a battery), one or more power-on switches and such othercircuitry as may be deemed desirable for operation of the device (suchas an activation switch, a controller, a liquid crystal diode (LCD)display, a connector, a light emitting diode (LED), an audible indicator(e.g. a sound transducer), or combinations thereof), as well aselectrical output contacts for electrically connecting the electricalmodule to a reservoir module. When obtained by the user, the electricalmodule is separated from the reservoir module. In this state, thebattery is maintained outside of the electrical circuit (though withinthe electrical module), thereby preventing the battery from dischargingthrough the circuit prior to use. Because the battery is electricallyisolated from the circuit prior to combining the electrical andreservoir modules, the circuitry has essentially no electrical chargeapplied to it prior to combination of the two modules, rendering thecircuitry far less susceptible to corrosion than if the battery were inthe circuit. In some variations the off-current module may be configuredto operate even when the two parts of the device/system are notconnected (e.g., even with the device powered off, and/or with thebattery driving drug delivery disconnected). Thus, a separate powersource/batter may power the off-current module in some variations. Inother variations the off-current module may be configured to operatewhen the device is in an off state, but otherwise powered on (e.g., whenthe two halves of the system/device are connected). In any of thevariations described herein the off-current module may be electricallyisolated from the drug delivery sub-components of the device/system.Thus, even if a short occurs in the drug delivery component of thedevice, the off-current module may operate.

The reservoir module may contain electrodes and reservoirs for deliveryof therapeutic agent to a patient. At least one reservoir may containthe therapeutic agent to be delivered. At least one counter reservoir isprovided, which generally contains no therapeutic agent, though in someembodiments it is possible for the counter reservoir to containtherapeutic agent. Prior to being connected to the electrical module,the reservoir module is maintained both physically and electricallyisolated from the electrical module. For example, one or both of themodules may be sealed in a pouch, such as a plastic or foil pouch, inorder to prevent contamination with water, particulates, vapors, etc. Asa non-limiting example, both the electrical and the reservoir modulesmay be sealed in the same pouch. As a further non-limiting example, thereservoir module may be sealed in a pouch and the electrical module leftoutside the sealed pouch. In other non-limiting examples, the twomodules may be sealed in separate pouches.

Prior to use (e.g. just prior to use) the electrical module is combinedwith the reservoir module to form a single unit, which in a singleaction, connects the battery into the circuit and powers the device on.The terms “prior to use” and “just prior to use” are described in moredetail hereinafter. In general, these terms are intended to indicatethat the two parts of the device are combined by a user, and that thedevice is then used to deliver therapeutic agent to a patient within apredetermined window of time—e.g. from 0 to 8 hrs. or from 0 to 72hours—after the two parts of the device are combined. This predeterminedwindow of time may vary, depending upon the therapeutic agent, theamount of agent to be delivered, requirements of various regulatoryagencies, etc. For the sake of clarity, it is to be understood thatcombination of the electrical and reservoir modules is postponed aftermanufacture and is carried out at the point of use so that duringshipping and storage the power source enclosed within the electricalmodule is electrically isolated from the circuitry until the two modulesare combined by the user.

As stated before, combination of the electrical and reservoir modulesconnects the battery into the circuit to achieve a powered on state,without any additional action required on the part of the user. Forexample, there is no need for the user to activate a power switch orremove a tab in order to connect the battery into the circuit. Once thetwo modules have been properly combined, power is supplied to thecircuitry. The circuitry can then operate normally. Normal operation mayinclude various circuitry tests, operation of various indicators (suchas the aforementioned LCD, LED and sound transducers), setting ofvarious logic flags, detection of error states and/or logic flags, etc.Normal operation also includes reception of an activation signal, e.g.through an activation button or switch, and providing power to theelectrodes through electrical outputs connected to electrical inputs onthe reservoir module.

In addition to reducing corrosion and battery discharge prior to use,another advantage of the device is that the electrical outputs from theelectrical module and inputs to the reservoir module (i.e. the contactsbetween the two modules) are electrically and physically separated fromthe power-on switches that connect the battery into the circuit. This isadvantageous, at least because it allows the power-on switches, whichconnect the battery into the circuit, to be kept entirely internal tothe electrical module. This in turn allows the contacts that comprisethe power-on switches to be kept contaminant-free, as the electricalmodule is at least in some embodiments sealed against contaminants, suchas water (including water vapor) and/or particulates. As describedherein, a power-on switch is closed by an actuator through anelastomeric seal, which permits the battery to be connected into thecircuit without the contacts that comprise the switch being exposed tothe environment external to the electrical module.

In some embodiments, two or more power-on switches are employed. In someparticular embodiments, the power-on switches are physically remote fromone another—e.g. on the order of from 0.1 cm to several cm. In someembodiments, the switches are at least 0.5 cm from one another.

As the two modules form a unitary device, they advantageously includeone or more mechanical coupler pairs to hold the two modules together.Such coupler pairs can include snap-snap receptacle pairs, which are insome embodiments designed to become inoperative (deform and/or break) ifthe two modules are forced apart after they are combined. Thus, devicesdescribed herein are well-suited for one time use, as they can beadapted to embody mechanical means for ensuring that the device is usedonly once.

In some embodiments, the device may alternatively, or additionally,employ electrical means for ensuring that the device is used only once.For example, an electrical means may employ a controller in theelectrical module which increments a power-on counter when the device ispowered on. In such embodiments, before or after the controllerincrements the counter, it detects the number of counts on the counter,and if it finds that the power-on counts exceed some predeterminedvalue, it executes a routine to power the device off. As a non-limitingexample the counter may initially be set to zero upon manufacturing. Thedevice may then be briefly powered on by an external power supply duringpost-manufacturing testing, which the controller interprets as onepower-on event, and thus increments the power-on counter by 1 count.Then when the device is assembled by the user prior to use, thecontroller interprets the connection of the battery into the circuit asa power-on event, and increments the power-on counter by 1. Thecontroller then detects the count on the counter. If the count is 2 orless, the controller permits the device to operate normally. If however,the count is 3 or more, the controller initiates a power-off sequence.

As a second, non-limiting example, the counter may initially be set tozero upon manufacturing. The device may then be briefly powered on by anexternal power supply during post-manufacturing testing, which thecontroller interprets as one power-on event, and thus increments thepower-on counter by 1 count. Then when the device is assembled by theuser prior to use, the controller detects the count on the counter. Ifthe count is 1 or less, the controller increments the power-on counterand permits the device to operate normally. If however, the count is 2or more, the controller initiates a power-off sequence.

Although reference is made here to counting power-on sequences, otherevents may be counted, either in place of power-on events, in additionto power-on events, or as a proxy for power-on events.

The power off sequence can be a sequence such as described in U.S. Pat.No. 6,216,003 B1, which is incorporated herein in its entirety.

In some embodiments, the device combines both mechanical (e.g. one-waysnaps) and electrical (e.g. power-on counter) means to ensure that thedevice cannot be used more than once.

A single use device/system may include multiple administrations of atherapeutic agent, e.g. within a particular window of time after thedevice has been powered on. The duration of time during whichtherapeutic agent may be administered and/or the number of total dosespermitted to be administered by the device may be predetermined andprogrammed into a controller. Means for controlling the number of dosesthat may be administered and/or the period during which therapeutic maybe administered are described e.g. in U.S. Pat. No. 6,216,003 B1, whichis incorporated herein in its entirety. For the sake of clarity, theterm “single use” is not intended to limit the device to a singleadministration of drug. Rather, the term “single use” is intended toexclude use of the device on more than one patient or on more than oneoccasion; it is also intended to exclude the use of an electrical modulewith more than one reservoir module and/or the reservoir module withmore than one electrical module and/or detachment of the reservoirmodule from the electrical module and reattachment. Thus, single usefeature is in some embodiments employed to prevent the patient oranother from saving drug and using it at a later time. In someembodiments, such a feature may be employed to prevent abuse of thetherapeutic agent.

In at least some embodiments of the device described herein, the deviceis configured to prevent contamination of the circuitry before andduring use in order to reduce the likelihood of device malfunction. Forexample, the use environment may include emergency room, operative,post-operative or other medical treatment environments, in whichpotential particulate and liquid are prevalent. Accordingly, at leastsome embodiments of the device are configured so that one or more sealsare formed in order to exclude ambient contaminants from ingress intothe working parts of the device, such as in particular the circuitry. Insome embodiments, one or more seals are formed around electricalcontacts between the electrical outputs on the electrical module and theelectrical inputs on the reservoir module.

In some embodiments, the power-on contacts are sealed from ingress ofcontaminants, such as particulates and fluids. In particularembodiments, the power-on contacts are sealed before the modules arecombined, during the act of combination, and after the two modules arecombined. In at least some such cases, the power-on contacts may beactuated (switched to a closed position) by an actuator that actsthrough an interposed elastomer, which maintains an impermeable sealwhile at the same time being deformed by an actuator (such as a post orother elongate member) to press the power-on contact into a closedposition.

Other seals are possible and may be desirable. For example, a seal maybe formed between the two parts (modules) when they are combined.

The device described herein may be appreciated by the person skilled inthe art upon consideration of the non-limiting examples, which aredepicted in the accompanying figures. Starting with FIG. 2A, anexemplary electrotransport device 10 is depicted. The device comprisestwo parts—an upper part, referred to herein as the electrical module20—and a lower part, referred to herein as the reservoir module 30. Theelectrical module 20 includes an electrical module body 200, which has atop (proximal) surface 220 and a bottom (distal) surface (not depictedin this view). The module body 200 has a rounded end 234 and a squaredoff end 254. The top surface 220 includes a window or aperture 204 forviewing an LCD display 208, an activation button 202 and an LED windowor aperture 232. An alignment feature 206 is also visible in this view.

The reservoir module 30 includes a reservoir module body 300, whichsupports electrodes, reservoirs (see description herein) and inputcontacts 316. In this view, there can be seen upper surface 320, onwhich input contact seals 322, circumscribe the input contacts 316. Theseals 322 form contaminant-impervious seals with corresponding memberson the electrical module 20 (see description herein). The upper surface320 of the reservoir module body 300 has a rounded end 352 and a squaredoff end 356. Also visible are snap receptors 310 and 312, which areconfigured to cooperate with corresponding snaps on the lower surface ofthe electrical module 20. In some embodiments, the snaps 310 and 312 areof different dimensions so that each can receive a snap of the correctdimension only, with the result that the device 10 cannot be assembledin the wrong orientation. As a visual aid to proper alignment of the twomodules 20, 30, the reservoir module 30 also has an alignment feature306, which a user can align with the alignment feature 206 on theelectrical module 20 to ensure that the two modules 20, 30 are properlyaligned.

Also visible in this view is a recess 314, which in some embodiments isof such a shape as to accept a complementary protruding member on thelower surface of the electrical module 20 in one orientation only. Therecess 314 and the protuberance on the electrical module 20 therebyperform a keying function, further ensuring that the two modules can beassembled in one orientation only and/or guiding the user to assemblethe two modules in the correct orientation. Another illustrative andnon-limiting keying (alignment) feature is the asymmetry of theelectrical module 20 with respect to the reservoir module 30. Asdepicted e.g. in FIG. 2A, the rounded end 234 of the electrical module20 corresponds to the rounded end 352 of the reservoir module; and thesquared off end 254 of the electrical module 20 corresponds to thesquared off end 356 of the reservoir module. The resulting asymmetryhelps the user align the electrical module 20 with the reservoir module30 and ensures that user can assemble the two modules in only oneorientation. While the rounded end is depicted in this illustration asbeing distal to the viewer, one of skill in the art will recognize thatthis is but one possible orientation. As a non-limiting example, therounded portion may be on the other end or one of the sides of thedevice. Additional keying features are discussed in more detail herein.

Also depicted in this view is one power-on post 318, which protrudesfrom the upper surface 320 of the reservoir module 30. The power-on post318 is configured to contact a corresponding feature on the electricalmodule to actuate power-on switches, thereby electrically connecting thebattery within the electrical module 20 into the circuitry containedtherein. These features will be described in greater detail below.However, it should be noted that, while there is only one power-on post318 depicted in this view, one of the intended power-on posts isobstructed by the perspective of the device. In some embodiments atleast two posts and at least two power-on switches are consideredadvantageous, in that this is considered the minimum number of switchesnecessary to electrically isolate the battery from the rest of thecircuit prior to use. However, this number is merely illustrative andany number of posts and power-on switches may be employed in the devicesdescribed herein.

Similarly, while there are two input contacts 322 depicted, and it isconsidered necessary that there be at least two such contacts—onepositive and one negative—this number is also illustrative only; and anynumber of contacts—e.g. two positive and one negative, one positive andtwo negative, two positive and two negative—equal to or greater than twomay be employed in devices according to this invention.

The two modules 20, 30 are combined (assembled) prior to use to form theunitary device 10 depicted in FIG. 2B, in which those parts that arevisible in FIG. 2B have the same numbers as used in FIG. 2A.

The device 10 may be further understood by considering FIG. 3, in whichthe electrical module 20 and the reservoir module 30 are depicted inexploded perspective views. In the left side of FIG. 3, electricalmodule 20 is visible with upper electrical module body 228, lowerelectrical module body 238 and inner electrical module assembly 248.Visible on the upper electrical module body 228 are the activationbutton 202, the LED aperture or window 232, the LCD aperture or window208. While it is also desirable in some embodiments to have an alignmentfeature on the upper electrical module body 228, this view does notinclude such an alignment feature.

Visible on the lower electrical module body 238 are the upper (proximal)surface of the elastomeric power-on receptacles 218 as well as springs224. The function of the springs 224 will be described in more detailbelow. At this point it is noted that the springs 224 provide bias forconnectors on the opposite side of the lower electrical module body 238.

The electrical circuit assembly 248 comprises a controller 244 beneathan LCD display 204 an LED 236 and an activation switch 242, all of whichare arranged on a printed circuit board (PCB) 252. Also barely visiblein this exploded view is the battery 290 on the lower side of PCB 252.The battery 290 fits within battery compartment 292 on the lowerelectrical module body 238. A flex circuit 294, which provides anelectrical connection from the PCB 252 to the LCD display 204, is alsodepicted in this view. The LCD display 204 may be configured tocommunicate various data to a user, such as a ready indicator, a numberof doses administered, a number of doses remaining, time elapsed sinceinitiation of treatment, time remaining in the device's use cycle,battery level, error codes, etc. Likewise the LED 236 may be used toprovide various data to a user, such as indicating that the power is on,the number of doses delivered, etc. The electrical circuit assembly 248may also include a sound transducer 246 which can be configured toprovide an audible “power on” signal, an audible “begin doseadministration” signal, an audible error alarm, etc.

The reservoir module 30 appears in exploded perspective view in theright hand side of FIG. 3. The reservoir module 30 comprises a reservoirbody 300, an electrode housing 370, an adhesive 380 and a release liner390. The upper surface 320 of reservoir body 300 includes the recess314, power-on posts 318, input connectors 316, seals 322 and couplerreceptacles 310 and 312. The electrode housing 370 includes reservoircompartments 388. Electrode pads 374 and reservoirs 376 are insertedwithin the reservoir compartments 388. The electrodes 374 make contactwith the input contacts 316 through the apertures 378. The adhesive 380,which provides means for attaching the device 10 to a patient, hasapertures 382, through which reservoirs 376 contact the skin of apatient when the adhesive 380 is attached to a patient. The removablerelease liner 390 covers the reservoirs 376 and the reservoirs 376 priorto use, and is removed in order to allow the device 10 to be attached toa patient. Assembled, the electrode pads 374 contact the underside ofthe input connectors 316 through apertures 378, providing an electricalconnection between the input connectors 316 and the reservoirs 376.Connection between the reservoirs 376 and the patient's skin is madethrough the apertures 382 after the release liner 390 is removed. Alsovisible in this view is a tab 372, which can be used to remove theelectrode housing 370 from the reservoir body 300 for disposal of thereservoirs 374, which in some embodiments contain residual therapeuticagent, after the device 10 has been used.

Another view of the reservoir module 30 appears in FIG. 4. In this view,the electrodes 374 are viewed through the apertures 378 in the reservoircompartments 388. Notable in FIG. 4 is the recess 314 has an indent 354,which is adapted to accept a complementary feature on the underside ofan electrical module. This is one of many possible keying that may beprovided for the device. In some embodiments, the recess 314 may receivethe underside of a battery compartment in the electrical module; howeverthe person skilled in the art will recognize that many such keyingfeatures are possible. One such keying feature may be the dimensions ofthe snap receptacles 310, 312 and the corresponding snaps, which permitassembly of the two modules in one configuration only. Other keyingfeatures could include the size and/or position of the electrical inputs316 on the reservoir module 30 and the corresponding electrical outputson the electrical module, the size and/or positions of the power-onposts 318, the complementary shapes of the reservoir module 30 and theelectrical module 20.

FIG. 5 is a cross section perspective view of an input connector 316 ona reservoir module 30. Visible in this view are the upper surface 320 ofthe reservoir body 300. Circumscribing the input connector 316 is a seal322. The seal 322 is configured to contact a corresponding seal on anelectrical module to prevent ingress of contaminants upon assembly ofthe device. The contact 316 is in some embodiments advantageously aplanar (flat or substantially flat) metallic contact. The contact may beessentially any conductive metal, such as copper, brass, nickel,stainless steel, gold, silver or a combination thereof. In someembodiments, the contact is gold or gold plated.

Also visible on the upper surface 320 of the reservoir module 30 is apower-on post 318 protruding from the surface 320. The lower portion ofinput connector 316 is configured to contact a reservoir (not pictured)through an aperture 378 in the reservoir compartment 388 in theelectrode housing 370.

Additionally, part of the battery receptacle 314 may be seen in FIG. 5.

FIG. 6 is another view of the two modules 20, 30 side by side. On theleft side of FIG. 6 is the bottom side of the electrical module body200; and on the right side is the top side of the reservoir module 30.The bottom surface 230 of electrical module body 200 has snaps 210, 212protruding therefrom, which are sized and shaped to fit within the snapreceptacles 310, 312 on the top of the reservoir module body 300. Asdiscussed above, in some embodiments snaps 210 and 212 are of differentsize so that snap 210 will not fit within snap receptacle 312 and/orsnap 212 will not fit within snap receptacle 310. This is one of severalkeying features that may be incorporated in the device 10. As anillustrative example, snap 212 cannot fit into 310, because snap 212 islarger than receptacle 310; but snap 210 can fit into receptacle 312,because it is the smaller snap and larger receptacle. In otherembodiments, it is possible to size both snaps and receptacles so thatthe one snap/receptacle pair is larger in one dimension (e.g.,horizontally), while the other snap/receptacle pair is larger in theother dimension (e.g., longitudinally). Another keying feature is theprotrusion 214, which may house the battery or other component, andwhich is shaped to fit in one configuration within recess 314 only.

The snaps 210, 212 are at least in some embodiments one-way snaps,meaning that they are biased so as to fit within the receptacles 310,312 in such a way that they are not easily removed, and in at least somepreferred embodiments, are configured to break (or deform to the extentthat they are no longer operable) if forced apart so that the modules20, 30 cannot be reassembled to form a single unitary device. In someembodiments, such a feature is provided as an anti-abuse character tothe device, such that the reservoir module 30 cannot be saved after useand employed with a different (or the same) electrical module 20.

The lower surface 230 of electrical module body 200 also has twoelectrical outputs 216, which are also referred to herein as output“hats”, which in certain embodiments are have one or more bumps 266protruding from the surface thereof. These hats 216 are circumscribed byhat seals 222. The hats 216 are configured to make contact with theinput connectors 316 on the reservoir body 300. Additionally, the hatseals 222 are configured to contact and create an impermeable seal withthe input seals 322. Advantageously the hat seals 222 are made of anelastomeric material that creates a contaminant-impermeable seal aroundthe hats 216 and, when mated with the input connector seals 322, createsfurther contaminant-impermeable seals.

The power-on receptacles 218 are configured to receive input posts 318.In some embodiments, the power-on receptacles 218 are made of adeformable (e.g. elastomeric) material. In some such embodiments, thepower-on posts 318 deform the power-on receptacles 218 so that theycontact power-on contacts (described in more detail below) and move themto a closed position, thereby connecting the battery into the circuit.Once the two modules 20, 30 are snapped together, the posts maintainpressure on the power-on contacts through the receptacles 218 and keepthe battery in the circuit.

While the hats 216 and input contacts 316 are depicted in FIG. 6 asbeing essentially the same size and symmetrically disposed along thelongitudinal axis of the device 10, another keying feature may beintroduced into the device by changing the relative size and/or positionwith respect to the longitudinal axis of the hats 216 and contacts 316,the power-on posts 318 and receptacles 218, etc.

A cross section of one embodiment of a power-on switch 270 is depictedin FIGS. 7A and 7B. The power-on switch 270 comprises movable contact272 and a stationary contact 274. Each of the movable contact 272 andthe stationary contact 274 is connected to a portion of the circuitry onthe printed circuit board (PCB) 252. In the open position depicted inFIG. 7A, the movable contact 272 is biased away from the stationarycontact 274, whereas in the closed position depicted in FIG. 7B, the twocontacts 272 and 274 are pressed together by the power-on post 318,which protrudes from the upper surface 320 of the reservoir module 30.The power-on post 318 acts through the flexible (elastomeric) power-onreceptacle 218 to force the movable contact 272 down until it is incontact with the stationary contact 274. For the sake of visibility, thestationary contact 274 is shown elevated from the PCB 252; however, itwill be understood that the stationary contact 274 need not be, andgenerally will not be, elevated from the PCB 252. In at least someembodiments, the stationary contact 274 will be an exposed metal traceon the surface of the PCB 252, though other configurations are alsopossible. The stationary contact 272 is manufactured from a suitablyspringy metal, such as a copper alloy, which is biased to remain in thefirst, open position unless acted on by the power-on post 318. Thereceptacle 218 may resemble a dome when viewed from the side of facingthe contacts 272, 274, and is at least in some embodiments formed of asuitable elastomeric substance that permits the power-on post 318 todeform it without rupturing the seal. In some embodiments, thereceptacle 218 may also be planar or may be domed in the oppositedirection. In at least some embodiments, the receptacle 218 provides acontaminant-tight seal between the external and internal parts of theelectrical module 20.

FIG. 8 shows a cross section of a part of a device 10 in an assembledstate. The device 10 comprises the upper electrical module 20,comprising an upper body 200, and the reservoir module 30, comprisingreservoir body 300, which are shown in this cross section view ascombined. Parts of the electrical module 20 that are visible in thiscross section view include the electrical module body 200, whichcontains a sound transducer 246, an LCD 204, controller 242, and battery290, all of which are on the printed circuit board (PCB) 252. A flexcircuit 294 provides a connection between the PCB 252 and the LCD 204.Also visible are the contact hat 216, which has bumps 266, and snap 210.As can be seen, the contact hat 216 is biased toward the reservoirmodule 30 by a coil spring 224, which fits within the contact hat 216and exerts a force through the contact hat 216 to press the contact hat216 against the input connector 316 of the reservoir module 30. The hat216 is circumscribed by a hat seal 222, which contacts the hat 216through its full length of travel. In at least some embodiments, thishat seal 222 is an elastomeric seal that provides a contaminant-tightfit between the hat seal 222 and the hat 216, whereby the electricalmodule 20 is sealed against contaminants such as particles and fluids(e.g. humidity) in the environment.

The reservoir module 30 includes a reservoir 376 and an electrode 374within the reservoir compartment 388 in the electrode housing 370, whichalso has an electrode housing tab 372. In the assembled state, the snap210 catches on the ledge 324 of the snap receptacle 310. At least insome embodiments, the snap 210 is made of a resilient polymer and isbiased to maintain contact with the ledge 324 so that the two modules20, 30 cannot be easily separated. In some preferred embodiments, thesnap 210 is configured so that if the two modules 20, 30 are separated,the snap 210 (and/or the ledge 324) will break (or deform to the extentthat they are no longer operable) and thereafter be unable to couple thetwo modules together.

Also depicted in this view is an input connector seal 322, which in thisillustration forms a ridge 326 (input connector seal ridge) thatcircumscribes the input connector 316. When the two modules 20, 30 areassembled, this input connector seal ridge 326 contacts and presses intothe elastomeric hat seal 222, thereby preventing ingress ofcontaminants, such as particulates and liquids, into the spacecontaining the output contact hat 216 and the input contact 316.

The hat 216 projects through the aperture 378 in the reservoircompartments 388. At least the bumps 266 on the hat 216 contact theinput connector 316 to provide electrical contact between the electricalmodule 20 and the reservoir module 30. The spring 224 providesmechanical bias to force the bumps 266 to maintain contact with theinput connector 316. Although the hat 216 is shown being biased by acoil spring 224, the person having skill in the art will recognize thatother springs and spring-like devices can be used within the scope ofthe device described herein. For example, and without limitation, thecoil spring 224 could be replaced by a beam spring or similar device.

As can be seen in FIG. 9, which is a high level schematic diagram of theelectronics 50 within the electrical module 20, the electronics 50 canbe envisioned as including circuitry 40 (which includes the controller,various indicators, etc.) connected to the battery 290 through power-onswitches S1 and S2 (which correspond to power-on switch 270 in FIGS. 7A,7B). The circuitry 40 controls delivery of voltage Vout through theoutputs 216 a, 216 b, which connect to corresponding inputs on thereservoir module. It is to be understood that, although theconfiguration of power-on switches S1 and S2 shown in FIGS. 7A and 7B isconsidered to provide certain advantages, such as ease of operation andmanufacture, other configurations of switches may be employed within thescope of the device described herein. Such switches may include slidesswitches that are mechanically biased toward the open position, whichmay be pushed to the closed position by a power-on post or similaractuator. As can be seen in this figure, the circuit 50 comprising thebattery 209 and the rest of the circuitry 40 is only completed if bothS1 and S2 are both held closed. Prior to S1 and S2 being closed, e.g.through the mechanical action of power-on posts, the battery 290 isisolated from the circuitry 40, as the circuit is open and does notallow current to flow through it. As mentioned before, this reducesbattery drain prior to use and greatly reduces corrosion, as thecircuitry has no power supply, and thus no extrinsic charge, applied toit. Also, if during handling prior to use one of the switches happens toclose, e.g. for a brief period of time, the device will not power on. Atleast in some embodiments, it is considered advantageous for thecontroller to detect spurious short-lived closing of both switches S1and S2 in order to account for occasional, accidental closing of theswitches before use. Also, as discussed above, it is consideredadvantageous in some embodiments that the two switches S1 and S2 bephysically and/or electrically remote from one another. Separation ofthe two switches reduces the likelihood that something that causes oneof the switches to malfunction (e.g. close, whether permanently,reversibly or intermittently) will not also affect the other switch.Additionally or alternatively, the two switches may be located on twodifferent sides of the battery or on the same side of the battery. Thus,while in FIG. 9 the switches S1, S2 are depicted on the positive (+)side of the battery 290, one or both could be located on the other sideof the battery. Thus, 1, 2, 3 or more switches may be located on one(positive or negative) side of the battery and 0, 1, 2, 3 or moreswitches may be located on the other (negative or positive) side of thebattery. Physical separation of the two switches may be from 0.1 cm toseveral cm, and in some embodiments at least 0.5 cm.

Also apparent is FIG. 9 is that the switches S1, S2 are remote from theoutputs 216 a, 216 b. Thus, the outputs from the electrical module tothe reservoir module are separated from the switches S1, S2. Though insome preferred embodiments the closing of switches S1, S2 occurs as aresult of the same action that connects the outputs 216 a, 216 b to thecorresponding inputs on the reservoir module, the switches S1, S2 areremote from the outputs 216 a, 216 b. This allows switches S1, S2 to beentirely internal to the electrical module, and in some embodiments tobe sealed against ingress of contaminants, such as water (includingvapor) and/or particulates.

FIGS. 10 and 11 provide two alternative power-on sequences for a device10 according as described herein. The first alternative shows that inthe first step, S502, four events occur all at once in a single actionby the user: the snaps are snapped into their respective receptacles;the output and input contacts are mated to provide electrical contactbetween the reservoirs in the reservoir module and the circuitry in theelectrical module; the power-on posts close the power-on switches in theelectrical module; and the battery is thereby connected into the circuitand begins providing power to the circuitry. In step S504 the controllerwaits a minimum period of time (e.g. 10-500 ms) before proceeding to thenext step. In some embodiments, S504 is eliminated from the power-onsequence. In embodiments in which S504 is included in the power-onsequence, if the controller fails to maintain power for a predeterminedminimum period of time, that is, e.g. power is lost during thistimeframe, the timer resets to zero. Presuming that power is maintainedthrough the time period of step S504, the controller then increments thepower-on counter by 1 in step S506. In step S508, the controller thenchecks the number of counts on the power-on counter, and if it is lessthan or equal to a certain predetermined number (in this example 2,presuming that the counter had been set to 1 by an in-factory test,though other values are possible) the controller proceeds to step S510,which includes a self-check. If, however, the count is greater than thepredetermined number, then the controller initiates step S516, whichincludes a power off sequence, which may include sending an errormessage to an LCD display, activating an LED indicator and/or soundingan audible alarm. If the count is less than or equal to thepredetermined number, the controller initiates step S510. After theself-check of S510 is completed, the controller determines whether thecircuitry has passed the self-check, and if not, it initiates step S516.If the circuitry passes the self-test check, the controller theninitiates S512, which may include signaling the user that the device isready (e.g. through the LCD, LED and/or sound transducer). The device isthen ready to be applied to the body of a patient and operated normally,e.g. as described in U.S. Pat. No. 6,216,033 B1, which is incorporatedherein by reference in its entirety.

A second alternative in FIG. 11 shows that in the first step, S602, fourevents occur all at once in a single action by the user: the snaps aresnapped into their respective receptacles; the output and input contactsare mated to provide electrical contact between the reservoirs in thereservoir module and the circuitry in the electrical module; thepower-on posts close the power-on switches in the electrical module; andthe battery 290 is thereby connected into the circuit and beginsproviding potential to the circuitry. In step S604 the controller waitsa minimum period of time (e.g. 10-500 ms) before proceeding to the nextstep. If the controller fails to maintain power for this period of time,that is, power is lost during this timeframe, the timer resets to zero.Presuming that power is maintained through the time period of step S604,the controller then checks the number of counts on the power-on counterin S606, and if it is less than or equal to a certain predeterminednumber (in this example 1, presuming that the counter had been set to 1by an in-factory test, though other values are possible) the controllerproceeds to step S610, which includes a self-check. If, however, thecount is greater than the predetermined number, then the controllerinitiates step S616, which includes a power off sequence, which mayinclude sending an error message to an LCD display, activating an LEDindicator and/or sounding an audible alarm. If the count is less than orequal to the predetermined number, the controller initiates step S610.After the self-check of S610 is completed, the controller determineswhether the circuitry has passed the self-check, and if not, itinitiates step S616. If the circuitry passes the self-test check, thecontroller then initiates S612, which includes incrementing the counterby 1. The controller then initiates S614, which may include signalingthe user that the device is ready (e.g. through the LCD, LED and/orsound transducer). The device is then ready to be applied to the body ofa patient and operated normally, e.g. as described in U.S. Pat. No.6,216,033 B1, which is incorporated herein by reference in its entirety.

Briefly described, the device is applied to the surface of a patient'sskin. The patient or a healthcare professional may then press the button202 (see, e.g., FIGS. 2A, 2B, and 3). In some embodiments, the device isconfigured to require the patient or healthcare professional to pressthe button twice within a predetermined timeframe in order to preventaccidental or spurious administration of the therapeutic agent. Providedthe patient or healthcare professional properly presses the button 202,the device 10 then begins administering the therapeutic agent to thepatient. In between the doses, the device may enter a “Ready” modeduring which the delivery is “off” even though the device is powered on.While in the Ready mode, the device may also perform a number ofself-test including the off-current self-test described above. If theuser presses the button to receive another dose, the device may firstperform one or more self-tests (including the off-current self-test)before delivering the dose (entering the activated state and deliveringdosage by passing current between the anode and cathode). Once apredetermined number of doses have been administered and/or apredetermined period of time has elapsed since the device was poweredon, the device initiates a power off sequence, which may include sendinga power off signal to the user through an LCD display, an LED and/or anaudio transducer. See especially the claims of U.S. Pat. No. 6,216,033B1, which are incorporated herein by reference.

The person skilled in the art will recognize that other alternativepower-on sequences may be employed. For example, the controller mayincrement the counter immediately after the counter check in the processoutlined in FIG. 10 or 11.

The reservoir of the electrotransport delivery devices generally containa gel matrix, with the drug solution uniformly dispersed in at least oneof the reservoirs. Other types of reservoirs such as membrane confinedreservoirs are possible and contemplated. The application of the presentinvention is not limited by the type of reservoir used. Gel reservoirsare described, e.g., in U.S. Pat. Nos. 6,039,977 and 6,181,963, whichare incorporated by reference herein in their entireties. Suitablepolymers for the gel matrix can comprise essentially any syntheticand/or naturally occurring polymeric materials suitable for making gels.A polar nature is preferred when the active agent is polar and/orcapable of ionization, so as to enhance agent solubility. Optionally,the gel matrix can be water swellable nonionic material.

Examples of suitable synthetic polymers include, but are not limited to,poly(acrylamide), poly(2-hydroxyethyl acrylate), poly(2-hydroxypropylacrylate), poly(N-vinyl-2-pyrrolidone), poly(n-methylol acrylamide),poly(diacetone acrylamide), poly(2-hydroxylethyl methacrylate),poly(vinyl alcohol) and poly(allyl alcohol). Hydroxyl functionalcondensation polymers (i.e., polyesters, polycarbonates, polyurethanes)are also examples of suitable polar synthetic polymers. Polar naturallyoccurring polymers (or derivatives thereof) suitable for use as the gelmatrix are exemplified by cellulose ethers, methyl cellulose ethers,cellulose and hydroxylated cellulose, methyl cellulose and hydroxylatedmethyl cellulose, gums such as guar, locust, karaya, xanthan, gelatin,and derivatives thereof. Ionic polymers can also be used for the matrixprovided that the available counterions are either drug ions or otherions that are oppositely charged relative to the active agent.

Incorporation of the drug solution into the gel matrix in a reservoircan be done in any number of ways, i.e., by imbibing the solution intothe reservoir matrix, by admixing the drug solution with the matrixmaterial prior to hydrogel formation, or the like. In additionalembodiments, the drug reservoir may optionally contain additionalcomponents, such as additives, permeation enhancers, stabilizers, dyes,diluents, plasticizer, tackifying agent, pigments, carriers, inertfillers, antioxidants, excipients, gelling agents, anti-irritants,vasoconstrictors and other materials as are generally known to thetransdermal art. Such materials can be included by on skilled in theart.

The drug reservoir can be formed of any material as known in the priorart suitable for making drug reservoirs. The reservoir formulation fortransdermally delivering cationic drugs by electrotransport ispreferably composed of an aqueous solution of a water-soluble salt, suchas HCl or citrate salts of a cationic drug, such as fentanyl orsufentanil. More preferably, the aqueous solution is contained within ahydrophilic polymer matrix such as a hydrogel matrix. The drug salt ispreferably present in an amount sufficient to deliver an effective doseby electrotransport over a delivery period of up to about 20 minutes, toachieve a systemic effect. The drug salt typically includes about 0.05to 20 wt % of the donor reservoir formulation (including the weight ofthe polymeric matrix) on a fully hydrated basis, and more preferablyabout 0.1 to 10 wt % of the donor reservoir formulation on a fullyhydrated basis. In one embodiment the drug reservoir formulationincludes at least 30 wt % water during transdermal delivery of the drug.Delivery of fentanyl and sufentanil has been described in U.S. Pat. No.6,171,294, which is incorporated by reference herein. The parameter suchas concentration, rate, current, etc. as described in U.S. Pat. No.6,171,294 can be similarly employed here, since the electronics andreservoirs of the present invention can be made to be substantiallysimilar to those in U.S. Pat. No. 6,171,294.

The drug reservoir containing hydrogel can suitably be made of anynumber of materials but preferably is composed of a hydrophilicpolymeric material, preferably one that is polar in nature so as toenhance the drug stability. Suitable polar polymers for the hydrogelmatrix include a variety of synthetic and naturally occurring polymericmaterials. A preferred hydrogel formulation contains a suitablehydrophilic polymer, a buffer, a humectant, a thickener, water and awater soluble drug salt (e.g. HCl salt of a cationic drug). A preferredhydrophilic polymer matrix is polyvinyl alcohol such as a washed andfully hydrolyzed polyvinyl alcohol (PVOH), e.g. MOWIOL 66-100commercially available from Hoechst Aktiengesellschaft. A suitablebuffer is an ion exchange resin which is a copolymer of methacrylic acidand divinylbenzene in both an acid and salt form. One example of such abuffer is a mixture of POLACRILIN (the copolymer of methacrylic acid anddivinyl benzene available from Rohm & Haas, Philadelphia, Pa.) and thepotassium salt thereof. A mixture of the acid and potassium salt formsof POLACRLIN functions as a polymeric buffer to adjust the pH of thehydrogel to about pH 6. Use of a humectant in the hydrogel formulationis beneficial to inhibit the loss of moisture from the hydrogel. Anexample of a suitable humectant is guar gum. Thickeners are alsobeneficial in a hydrogel formulation. For example, a polyvinyl alcoholthickener such as hydroxypropyl methylcellulose (e.g. METHOCEL K100 MPavailable from Dow Chemical, Midland, Mich.) aids in modifying therheology of a hot polymer solution as it is dispensed into a mold orcavity. The hydroxypropyl methylcellulose increases in viscosity oncooling and significantly reduces the propensity of a cooled polymersolution to overfill the mold or cavity.

Polyvinyl alcohol hydrogels can be prepared, for example, as describedin U.S. Pat. No. 6,039,977. The weight percentage of the polyvinylalcohol used to prepare gel matrices for the reservoirs of theelectrotransport delivery devices, in certain embodiments can be about10% to about 30%, preferably about 15% to about 25%, and more preferablyabout 19%. Preferably, for ease of processing and application, the gelmatrix has a viscosity of from about 1,000 to about 200,000 poise,preferably from about 5,000 to about 50,000 poise. In certain preferredembodiments, the drug-containing hydrogel formulation includes about 10to 15 wt % polyvinyl alcohol, 0.1 to 0.4 wt % resin buffer, and about 1to 30 wt %, preferably 1 to 2 wt % drug. The remainder is water andingredients such as humectants, thickeners, etc. The polyvinyl alcohol(PVOH)-based hydrogel formulation is prepared by mixing all materials,including the drug, in a single vessel at elevated temperatures of about90 degree C. to 95 degree C. for at least about 0.5 hour. The hot mix isthen poured into foam molds and stored at freezing temperature of about−35 degree C. overnight to cross-link the PVOH. Upon warming to ambienttemperature, a tough elastomeric gel is obtained suitable for ionic drugelectrotransport.

A variety of drugs can be delivered by electrotransport devices. Incertain embodiments, the drug is a narcotic analgesic agent and ispreferably selected from the group consisting of fentanyl and relatedmolecules such as remifentanil, sufentanil, alfentanil, lofentanil,carfentanil, trefentanil as well as simple fentanyl derivatives such asalpha-methyl fentanyl, 3-methyl fentanyl and 4-methyl fentanyl, andother compounds presenting narcotic analgesic activity such asalphaprodine, anileridine, benzylmorphine, beta-promedol, bezitramide,buprenorphine, butorphanol, clonitazene, codeine, desomorphine,dextromoramide, dezocine, diampromide, dihydrocodeine, dihydrocodeinoneenol acetate, dihydromorphine, dimenoxadol, dimeheptanol,dimethylthiambutene, dioxaphetyl butyrate, dipipanone, eptazocine,ethylmethylthiambutene, ethylmorphine, etonitazene, etorphine,hydrocodone, hydromorphone, hydroxypethidine, isomethadone,ketobemidone, levorphanol, meperidine, meptazinol, metazocine,methadone, methadyl acetate, metopon, morphine, heroin, myrophine,nalbuphine, nicomorphine, norlevorphanol, normorphine, norpipanone,oxycodone, oxymorphone, pentazocine, phenadoxone, phenazocine,phenoperidine, piminodine, piritramide, proheptazine, promedol,properidine, propiram, propoxyphene, and tilidine.

Some ionic drugs are polypeptides, proteins, hormones, or derivatives,analogs, mimics thereof. For example, insulin or mimics are ionic drugsthat can be driven by electrical force in electrotransport.

For more effective delivery by electrotransport salts of certainpharmaceutical analgesic agents are preferably included in the drugreservoir. Suitable salts of cationic drugs, such as narcotic analgesicagents, include, without limitation, acetate, propionate, butyrate,pentanoate, hexanoate, heptanoate, levulinate, chloride, bromide,citrate, succinate, maleate, glycolate, gluconate, glucuronate,3-hydroxyisobutyrate, tricarballylicate, malonate, adipate, citraconate,glutarate, itaconate, mesaconate, citramalate, dimethylolpropinate,tiglicate, glycerate, methacrylate, isocrotonate,.beta.-hydroxibutyrate, crotonate, angelate, hydracrylate, ascorbate,aspartate, glutamate, 2-hydroxyisobutyrate, lactate, malate, pyruvate,fumarate, tartarate, nitrate, phosphate, benzene, sulfonate, methanesulfonate, sulfate and sulfonate. The more preferred salt is chloride.

A counterion is present in the drug reservoir in amounts necessary toneutralize the positive charge present on the cationic drug, e.g.narcotic analgesic agent, at the pH of the formulation. Excess ofcounterion (as the free acid or as a salt) can be added to the reservoirin order to control pH and to provide adequate buffering capacity. Inone embodiment of the invention, the drug reservoir includes at leastone buffer for controlling the pH in the drug reservoir. Suitablebuffering systems are known in the art.

The device described herein is also applicable where the drug is ananionic drug. In this case, the drug is held in the cathodic reservoir(the negative pole) and the anoidic reservoir would hold the counterion.A number of drugs are anionic, such as cromolyn (antiasthmatic),indomethacin (anti-inflammatory), ketoprofen (anti-inflammatory) andketorolac tromethamine (NSAID and analgesic activity), and certainbiologics such as certain protein or polypeptides.

Although the device and systems for drug delivery including anoff-current self-test (and therefore an off-current module to performthe self-test) may be or include two-part drug delivery devices asdescried above, the off-current module may be included as part ofvirtually any drug delivery system having a powered on, but delivery-off(e.g., “Ready”) mode in which drug is not to be delivered untilappropriately triggered. Thus one-part, unitary drug delivery devicesare also contemplated.

Any of the systems and devices describe herein, including a two-partsystem as exemplified may include logic for controlling the self-tests,including the off-current (aka anode-cathode voltage difference)self-test. Described in Example 2 below, and accompanying figures, isone variation of a system and control logic to be implemented on thesystem, including an off-current self-test. This exemplary logicincludes an off-current module, and may be implemented on the two-partsystem described in Example 1, above.

Example 2 Control Logic

In one example, a system/device including an off-current control moduleconfigured to include an off-current self-test may include a processoror other controller executing control logic. For convenience, thiscontrol logic is referred to herein as software, however it should beunderstood that it may include hardware, firmware, or the like, inaddition to software.

The following acronyms used in this example are defined below:

Term Definition ITSIC ASIC designed and produced for/by this exampleASIC Application-Specific Integrated Circuit IONSYS ™ FentanylIontophoretic Transdermal System ITSIC Specific Integrated Circuit(formerly called ALZIC) for this example JTAG (Joint Test Action Group)An interface to the ITSIC that allows access and control by externalequipment Nibble Half of an 8-bit byte. Four bits aligned on bit zero orbit four of an 8-bit byte Syndrome Bit Hamming Code parity bit TDITechnical Design Input UML Unified Modeling Language

In this example, the software (control logic) described herein may berun on the ITSIC ASIC, which contains a CAST R80515 CPU core. Inaddition to the core, the ITSIC contains peripherals for interfacingwith input/output devices including buttons, LEDs, an LCD, and a piezotransducer. The ITSIC also includes a high-voltage boost converter, acurrent source, and an analog-to-digital converter (ADC).

The exemplary CAST R80515 core operates at 32 kHz and takes between oneand six cycles to execute each instruction. This equates to executiontimes ranging from 31.25 to 187.5 μs is per instruction. The ITSICcontains 256 bytes of RAM, of which 32 bytes are reserved for coreregisters, 1024 bytes of non-volatile storage in the form of EEPROMarranged in 64-bit pages, and 16 KB of ROM for program memory. The ITSICcan execute code from program memory in internal ROM, or from externalEEPROM. The transfer of execution from internal ROM to external EEPROMis controlled by a hardware register setting that may be configured viaJTAG or by software.

The IT101 may operate in one of seven modes, determined by user input,defined operational parameters, and device internal status. FIG. 12shows the behavior of each mode and the transitions between modes.

FIG. 13 shows the high-level decomposition of the software intofunctional blocks. The software architecture in this example is modularand layered, with low-level driver modules encapsulating and providingan interface to electronic hardware, while higher-level applicationmodules utilize drivers to provide device functionality to the user.Lower-layer modules are independent of modules in layers above them.

Before entering the state machine, the software goes through aninitialization routine. This routine includes checking the RAM andEEPROM for corruption, checking the boot mode, and initializing thedrivers. More details of this initialization can be seen in FIG. 14.

The ITSIC supports execution from either internal Mask ROM or anexternal EEPROM. The default configuration is execution from ROM. Inaddition, the software includes a Hold Mode which initializes the systemthen enters an infinite loop to allow external control via the JTAGlines. Hold mode does not service the watchdog timer, so if externalcontrol isn't asserted prior to the first expiration of the watchdog,the watchdog will reset the system. The boot mode of the system isdetermined by the boot flag in NVM.

During system initialization, the EEPROM is initialized and the firstpage is checked for data integrity. If the boot flag value is notcorrupt, the value is read from EEPROM.

If the flag is set to Normal, the software continues to run from ROM. Ifthe flag is set to External, the EXTMEM register is set by software,which resets the CPU and subsequently boots from external EEPROM. If theflag is set to Hold, the drivers are first initialized, and then thesoftware enters Hold Mode.

Processing of tasks in the system may be periodic and synchronized witha system tick occurring every eight milliseconds. The system tickfunction is provided by the Timer driver, using a periodic hardwareinterrupt to produce the tick. The main loop simply waits for the systemtick to occur, then calls the appropriate processing functions for theTimer driver and the state machine.

The Timer processing function updates any active timers, such as thosefor dose time and system lifetime. The state machine processing functiondispatches processing to the currently-active state, which then executesits periodic tasks. Periodic tasks may be scheduled to run as frequentlyas every 8 ms, or with any period that is an integer multiple of 8 ms,up to 2.048 seconds. The upper limit on the period is fixed by rolloverof the 8-bit system tick counter. The Timer driver provides functions tofacilitate periodic execution at various rates. To reduce demands on theprocessor core, tasks may be scheduled to run at rates no faster thannecessary.

There is a single thread of execution that executes tasks in anon-preemptive, run-to-completion model. The active task must completebefore the next task can run, so no task is allowed to wait for anextended period for an event to occur. If execution of a particular taskruns past the scheduled time for one or more other tasks, the delayedtask(s) will be executed in order, upon completion of the delaying task.Execution of all periodic processing tasks will generally take longerthan the duration of a single system tick. Normal scheduling willcontinue on the next system tick.

The software in this example operates as a finite state machine, thebehavior of which is defined in the UML state chart shown in FIG. 15.The state machine is implemented with state processing and transitionsmanaged centrally by the StateMachine module. Each state has entry andexit functions, as well as a processing function. The current state ofthe system is stored in a single private variable within theStateMachine module.

Each time a system tick occurs, the main loop calls the state machineprocessing function, which in turn calls the processing function for thecurrent state. If processing of the current state results in atransition, the processing function returns a reference to the newstate. The state machine then calls the exit function for the currentstate, changes the state variable, then calls the entry function for thenew state. This assures that the state of the system remains consistentat all times, with guaranteed state entry and exit actions performed inthe correct order. If a state's processing function does not result in atransition, it returns null, and no state change takes place.

Each state contains its own list of periodic tasks that are executed atthe appropriate rates by its processing function. Tasks are scheduled ina rate-monotonic fashion—the periodic tasks with the highest rate ofexecution are executed first, followed by tasks in order of decreasingexecution rate. This minimizes the variability in the period,particularly for the tasks with the highest execution rates. Taskscheduling is static and fixed at compile time, so priority isdeterministic.

States

Power-on Self-Test State

In the Power-On Self-Test (POST) state, the software exercises the userinterface elements and executes a sequence of self-tests. At power-on,the beeper sounds a 250 ms, 2000 Hz tone. After the tone, the red LEDflashes once for 500 ms. After the LED flash, the LCD flashes ‘88’ onceper second for the remainder of POST.

While the user interface elements are being exercised, the softwareexecutes a sequence of self-tests to confirm that the device hardware isoperating correctly. In order to complete POST as quickly as possible,the tests run continuously until they complete, rather than utilizing aperiodic task for execution. There are two periodic tasks in the POSTstate. A 250-ms task is used to produce the user interface sequences. Aone-second task is used to service the watchdog.

Ready State

In the Ready state, the software looks for button input, flashes thegreen LED for a half second every two seconds and periodically runsself-tests according to schedule. There are three periodic tasks in theReady state, executing with periods of 50 ms, 250 ms, and one second.

The 50-ms task is used to detect button presses, using the functionsprovided by the Button driver. The software looks for a dose request,defined as two button presses separated by at least 0.3 seconds and atmost three seconds. The time is measured from the point of the firstpress to the point of the second release. On each detected buttonrelease, the software performs an Analog Switch Validation Test. When adose request is detected, the software performs a Digital SwitchValidation Test. If all tests pass, a transition to Dosing state isinitiated.

The 250-ms task is used to produce the flashing sequence of the greenLED. The green LED is turned on for half a second every two seconds.

The one-second task is used to schedule and execute self-tests, andservice the watchdog.

Dosing State

The Dosing State is responsible for delivering the 170 μA drug deliverycurrent over the 10 minute dose. For reference, 16 illustrates onevariation of a the circuit controlling the anode and cathode. Thecurrent control block contains circuitry to connect the output of thevoltage boost converter (VHV) to the anode electrode (EL_A) through theswitch S1. The 10 bit DAC is used to configure the current output to aset value proportional to the desired dosing current. The DAC drivesAMP1 which controls the current flowing through EL_A and EL_C by drivingthe gate of M2. The drain of M2 determines the current flow throughRsense which causes the voltage drop that is fed back into AMP1. As theskin resistance between EL_A and EL_C varies, so does the currentthrough Rsense, which triggers a change in the output of AMP1. The VLOWsignal is used in mode 0 to monitor the output of AMP1 as it approachesthe saturation point of 2 volts. AMP1 becomes saturated if there is notsufficient voltage to deliver the programmed current with the resistancebetween EL_A and EL_C. Driver functions are available to control andmonitor various the points of this circuit.

The Dosing State is grouped into three sub-flows: dose initiationsequence, dose control and dose completion sequence. Upon transitionfrom Ready state to Dosing state the dose initiation sub-flow isstarted. In dose initiation the software configures the various pointsof the current control block and verifies their proper operation. Thedose control sub-flow is then started. This flow controls the deviceover the 10 minute dose, monitoring for error conditions and controllingboost voltage to conserve power. Finally, the dose completion sub-flowis started. This flow disables drug delivery and verifies correctoperation of the current source by measuring the various points in thecurrent control block.

The dose termination sequence is always run on exit of the Dosing stateindependent of the event that caused the software to exit the Dosingstate. The dose termination sequence always opens S1, sets the currentsource DAC to 0, sets the boost voltage to 0 and disables the boostcircuit. Further, the dose termination sequence disables both the greenLED and beeper. In some cases the dose termination sequence carries outactions already completed in the sub-flow processing. Almost all errorcases in the Dosing State flow are handled similarly—with a resultingtransition to dose termination. The exception to this is the handling ofPoor Skin Contact detection.

If an error occurs during dose initiation or dose completion thesoftware exits the Dosing State, completes the dose termination sequenceand transitions to End of Life. Likewise, if an error other than PoorSkin Contact is encountered during dose control, the software completesthe dose termination sequence and transitions to End of Life. When aPoor Skin Contact error is encountered in the Dosing State, the softwareimmediately starts the dose completion sequence, but the dose count isnot updated. When an error occurs in the dose completion sequence thesoftware immediately completes the dose termination sequence andtransitions to End of Life.

There are three periodic tasks in the Dosing state, executing withperiods of 50 ms, 500 ms and one second.

The 50-ms task is used to detect dose requests while in the dosingstate. The double button press detection mechanism is identical to Readymode, except switch validation tests are not run. If the softwaredetects a double button press in the dosing state, the dose requestcounter is incremented. This count is logged during dose-completion, butnot when handling a Poor Skin Contact error.

The 500-ms task is used only the first time its tick occurs. On thatfirst occurrence, the beeper is disabled.

The one-second task in this example is used to schedule the dose controlsub-flow and service the watchdog. The one second task also schedulesthe slower rate Dosing State self-tests (i.e. the ADC and ReferenceVoltage test, Oscillator Accuracy Test, Battery Voltage Test andSoftware Timer Integrity Test).

FIG. 17 shows a Dosing Mode Flow Diagram illustrating the high-levelflow between each of the dosing mode sub-flows, the dose terminationsequence and the transition to other states.

Dose Initiation Sequence

The dose initiation sequence starts by completing the sequence ofturning on the green LED and enables the piezo beeper at 2000 Hz for aduration of 500 milliseconds. The software then completes the requiredself-tests for dosing mode entry. At this point the software begins toconfigure the device for drug delivery.

First the software writes the initial boot voltage setting of 3.4375 Vand reads back the register to verify the write. Next, voltage boost isenabled and the software confirms that the boost circuit is operationalby measuring the boost voltage using the ADC. The software then verifiesthat S1 is open by measuring the voltage on EL_A and confirming that itis below 1.0 V. The software verifies that there is not a largepotential difference between the anode and cathode by completing theAnode/Cathode voltage difference test. Next, S1 is closed and thevoltage on EL_A is measured again to confirm that S1 is closed. Thesoftware verifies that the output current is off by conducting theOutput Current Off self-test. At this point the software sets thecurrent source DAC to the calibrated value to start current flow. Thesoftware reads back the register to verify the write. The software nextconducts the High Output Current self-test to verify that the currentsource is within range. Finally, the software measures both the anodeand the cathode and conducts two checks. The first verifies that thereis a voltage difference between EL_A and EL_C; the second verifies thatthe boost circuit is still able to supply the voltage with currentenabled. If the measured values are not as expected, the software hasdetected an error, completes the dose termination sequence andtransitions to End of Life. FIG. 18 shows a Dose Initiation FlowDiagram.

Dose Control Sequence

Upon successful completion of the dose initiation sequence the softwareenters dose control. The software starts the dose countdown timer with aduration of 10 minutes and begins the dose control loop on a 1 secondperiod.

Each time through the loop the software first verifies that the outputcurrent is below 187 μA by completing the High Output Current self-test.Next, the software verifies that EL_A is within tolerance of the currentVHV setting. After 1 minute has elapsed the Compromised Skin BarrierTest is performed each time through the loop and after 4 minutes haselapsed the Poor Skin Contact Test is performed each time through theloop.

After the self-tests are completed the software enters the VHV controlportion of the loop. The software controls VHV to provide enough voltageto deliver the drug current while minimizing power consumption. The VHVcontrol loop ramps the voltage to the necessary level, starting at3.4375 V but never going above 11.25 V. To control VHV the softwaremonitors the state of the VLOW signal. The VLOW signal is configured tomonitor the gate voltage of M2. The signal is asserted when the outputof AMP1 exceeds 2 V. The VLOW signal indicates that AMP1 is not able todeliver the 170 μA current because there is not sufficient sourcevoltage. If the VLOW signal is asserted, the software increments VHV by1 count (0.3125 V), up to a maximum of 11.25 V. The first severaliterations through the control loop ramp VHV to the necessarily level,depending on the skin resistance. If skin resistance increases duringthe dose, the VLOW signal is asserted and VHV is incrementedaccordingly.

To conserve power and handle decreasing skin resistance during dosedelivery, the software decrements VHV periodically. The decrement istriggered by a 20 second timeout. The timeout is set to 0 each time VHVis either incremented or decremented. The timeout is incremented eachtime that the control loop detects that the VLOW signal has not beenasserted. When the timeout reaches 20 (i.e. 20 seconds) VHV isdecremented. If the skin resistance has not changed the VLOW signal isasserted and the software increments VHV back to the necessary level thenext time through the loop. Otherwise, VHV stays at the new voltagesetting until the next timeout or the VLOW signal is asserted.

Finally the dose control sequence schedules the Dosing Mode self-teststhat occur with periods greater than 1 second. These tests are the ADCand Reference Voltage test, Oscillator Accuracy Test, Battery VoltageTest and Software Timer Integrity Test. If any of these self-tests failthe software completes the dose termination sequence and transitions toEOL.

If an error other than Poor Skin Contact is encountered during thecontrol loop, the software completes the dose termination sequence andtransitions to End of Life. If Poor Skin Contact is detected, thesoftware starts the dose completion sub-flow, but does not increment thedose count. The dose control loop is exited under normal conditions oncethe 10 minute dose time has elapsed. FIG. 19 shows the flow for dosecontrol.

Dose Completion Sequence

The dose completion sequence is started on successful delivery of a doseor when a Poor Skin Contact is detected. First the software opens S1 andsets the current source DAC to 0 counts. The register write is read backand verified. Next the software conducts the Output Current Offself-test to verify that current is not above the leakage threshold. Thesoftware sets VHV to 0 V and verifies the register write by reading itback. The software verifies that VHV is off by measuring VHV andverifying that it less than 4.0 V; the expected value is Vbat. Next, thesoftware disables the boost circuit and verifies the register write. Theanode voltage is measured to verify that the potential is low. Next, theAnode/Cathode voltage difference test (the off-current test) iscompleted.

If the software is handling Poor Skin Contact detection, it exits thedose completion sequence and transitions to Standby. Otherwise, thesoftware performs the dose count integrity test, if the test passes thedose count is incremented and the LCD is updated. If the dose count is80, the software transitions to End of Use, otherwise the softwaretransitions to Ready. If the software detects an error in the dosecompletion sequence, the dose termination sequence is completed and thesoftware transitions to End of Life. FIG. 20 shows one example of a flowdiagram for dose completion.

Standby State

The Standby state is used to indicate that poor skin contacted wasdetected during the Dosing state. On entry to the state, the softwarelogs a standby record with timestamp to NVM. While in Standby state, theoutput current is disabled, self-tests are suspended, and the softwareflashes the red LED twice a second and plays a sequence of long andshort tones on the beeper. After 15 seconds, the software transitions tothe Ready state.

The 250-ms task is used to produce the flashing sequence of the red LEDand the tones played on the beeper. This task is also used to detectwhen 15 seconds have passed and initiates the transition to the nextstate.

The one-second task is used to service the watchdog.

End of Use State

The software enters the End of Use state when the device has reached its80 dose limit or its time limit of 24 hours. On entry to the state, thesoftware logs the finish code, timestamp, and battery voltage to NVM.While in End of Use state, the output current is disabled, the finaldose count is displayed on the LCD, and the red LED flashes. Thesoftware monitors the button for a press and hold event, andperiodically executes self-tests.

The 50-ms task is used to detect button presses, using the functionsprovided by the Button driver. If the software detects a button pressand hold for 6 seconds, a transition to Shutdown state is initiated.

The 250-ms task is used to produce the flashing sequence of the red LED.

The one-second task is used to schedule and execute self-tests, andservice the watchdog. This task is also used to run the Battery VoltageTest once every 10 minutes. If the battery is below the low voltagethreshold, the software initiates a transition to the End of Life State.

End of Life State

On entry to the End of Life state, the software logs the reason fortransition, the timestamp, and the battery voltage to NVM. The devicemay enter the End of Life (EOL) state when forced by errors (includingfailing a self-test such as the off-current test). While in End of Lifestate, the output current is disabled, the red LED flashes and thebeeper sounds a sequence of short tones. The software monitors thebutton for a press and hold event, and periodically checks the batterylevel every 10 minutes.

The 50-ms task is used to detect button presses, using the functionsprovided by the Button driver. If the software detects a button pressand hold for 6 seconds, a transition to Shutdown state is initiated.

The 250-ms task is used to produce the flashing sequence of the red LEDand produce the short tones on the beeper.

The one-second task is used to schedule and execute self-tests, andservice the watchdog. This task is also used to run the Battery VoltageTest once every 10 minutes. If the battery is below the depletedthreshold, the software initiates a transition to the Shutdown State.

Shutdown State

The Shutdown state is the final state of the device. On entry to thestate, the software logs the reason for transition, the timestamp, andthe battery voltage to NVM and disables the LEDs, the LCD, and thebeeper.

While in the Shutdown state, the output current is disabled. Thesoftware does nothing but service the watchdog using the one-secondtask. The software does not exit this state.

Self-Tests

As discussed above, the system or device may include a set of self-teststo monitor the device operating parameters to detect faults in devicehardware or software, or in usage conditions. The off-current module maybe one form of a self-test. The self-test may derive from requirements,risk and reliability analysis activities. The tolerance ranges specifiedfor test limits derive included herein (including the thresholds such asthe Off-Current Threshold) are exemplary only. These example tolerancesmay depend upon tolerances of hardware components. Software, hardwareand firmware (including logic/algorithms) of the self-tests may checkagainst a specific limit value that does not vary.

Self-Test Scheduling and Sequencing

The subset of self-tests run and the scheduling of those tests may varydepending on the device's operating mode, as discussed above. FIG. 21shows table 1, which shows self-tests that can be run in each mode andwhen those tests run. Standby Mode is not shown because self-tests aredeferred until the return to Ready Mode. Standby lasts only 15 seconds,and with the most frequent tests running only once a minute innon-dosing modes, Standby mode would be exited before any tests wouldrun.

The test scheduling indicated in FIG. 21 is in some cases more frequentthan would be suggested by the detection times stated in therequirements. This allows for an implementation that requires severalconsecutive failures before a fault is set in cases where there may besignificant variability of measured results from test to test. In thecase of the Oscillator Accuracy Test, this allows fault detection withinthe required real time stated in the requirements, even if theoscillator is operating at the extreme low limit, just above the pointof a hardware reset.

In many cases the correct execution of a particular test depends on thecorrect operation of other hardware, firmware and/or software elementsthat are checked by other tests. This may help determine an order inwhich tests must run for valid results. Predecessor tests are those thatmust pass before the result of a given test can be considered valid. Forexample, the ADC and Reference Voltage Test must pass before any testusing the ADC runs.

One special case is the ROM Test. Because all code, including that forthe ROM Test, is stored in ROM, it's not possible to pass the ROM Testprior to using ROM.

RAM Test

The RAM Test verifies that each address in RAM can be read and writtento. The test is performed in assembly language startup code, before RAMand stack initialization or C startup. The values 0x55 and 0xAA arewritten to and then read from each byte of RAM to verify every bit isfunctioning. The test first writes 0x55 to each byte of RAM. Then itreads each byte, compares it to 0x55, and writes 0xAA to the byte.Finally, it reads each byte of RAM and compares the values to 0xAA. Ifany of the comparisons fail, the test fails. Otherwise, the test passes.

ROM Test

The ROM Test verifies the contents of ROM. The test calculates an 8-bitchecksum of ROM, which is a summation of all the values in ROM. Atmanufacture the last byte of ROM will be set so that the checksum willequal 0xFF. When the test is run, it calculates the checksum for the ROMand compares it to 0xFF. If the checksum is not equal to 0xFF, the testfails. Otherwise, the test passes.

Calibration Data Integrity Test

The Calibration Data Integrity Test verifies the contents of calibrationdata stored in the internal EEPROM. These data include the boot flag,the oscillator limit values, the calibrated current source DAC setting,the Rsense reading when pulled-up, and trimming values for the ADC andoscillator. These values are encoded with error detection and correctioncodes. The first time the calibration data integrity check runs, itdecodes all calibration values via the EEPROM driver and fails if theEEPROM driver detects uncorrectable data corruption in any of thevalues.

After being validated by a successful first integrity test, the ADCcalibration values are stored in RAM to improve the performance of theADC driver. On subsequent integrity checks of these values, the testcompares the values stored in RAM with the values stored in EEPROM. Thisreduces processing time by avoiding the overhead of decoding errorcodes. The test passes if the values in RAM and EEPROM match and failsotherwise.

For all calibration data other than the ADC calibration, subsequentintegrity tests behave the same as the first. Error codes are decodedfor all values, and any uncorrectable corruption results in a testfailure.

Oscillator Accuracy Test

The Oscillator Accuracy Test verifies the accuracy of the oscillatorfrequency using the frequency-to-voltage conversion channel of the ADC.During manufacturing, the oscillator is calibrated to 2.048 MHz±1%, andfrequency-to-voltage readings at high and low limits are stored innon-volatile memory. The stored limits are between +3% and +5% on thehigh side, and −3% and −5% on the low side. The tolerance on thefrequency-to-voltage converter is ±5%. The stack-up of these tolerancesmay result in the detection threshold being close to but not more than10% from nominal, which is within the required ±10% limits of theOscillator Accuracy Test.

When the Oscillator Accuracy Test runs, the 12-bit ADCfrequency-to-voltage reading is compared to the two 12-bit limit valuesstored in non-volatile memory. If the ADC reading is not within limits,the test fails. Otherwise, the test passes.

In order to detect an oscillator error within in the required real timein the case where the oscillator is running slow, the test will run morefrequently than it would if the oscillator were running at a nominalfrequency. reset occurs at 0.8 MHz. This is a divider of 2.5 on thenominal value of 2.048 MHz, and the same divider must be applied to thetest scheduling period. For example, in order to assure detection of alow-limit oscillator within 10 minutes, the test must run every 4minutes.

ADC and Reference Voltage Test

The ADC and Reference Voltage Test verifies the correct operation of theADC, the ADC multiplexer, and the relative levels of the ADC referencevoltage and the Main reference voltage. The test measures the Mainreference voltage using the ADC and compares it to 1 volt. In order forthe test to pass, the ADC, the ADC multiplexer, the Main voltagereference and the ADC voltage reference must all be functioningcorrectly. If the test fails, the component that is failing cannot bedetermined. The test fails if the Main reference voltage is greater than1.1 volts or less than 0.9 volts. Otherwise the test passes.

Software Timer Integrity Test

The Software Timer Integrity Test verifies the rate of the primarysoftware timers using a secondary software timer. The secondary softwaretimer is given a countdown length and the current value of one of theprimary timers. During Ready mode, the secondary timer initiates a checkof the primary system time every ten minutes. During Dosing mode, thesecondary timer initiates a check of the primary doing timer everyminute. After counting down for the specified length of time, thesecondary timer compares the current primary timer value to the initialvalue. If the values differ by more than 10% the test fails. Otherwise,the test passes.

Dose Count Integrity Test

The dose count integrity test verifies that the dose count value in RAMhas not become corrupted. A redundant copy of dose count is stored inthe internal EEPROM and initialized to zero. The test is run onsuccessful dose competition. Before incrementing the dose count, thecurrent value stored in RAM is compared against the copy in EEPROM. Ifthe two values match, they are both incremented and the EEPROM value iscommitted. If the two values do not match the test fails.

Rsense Accuracy Test

The Rsense Accuracy Test verifies the accuracy of the Rsense resistancevalue. The Rsense resistor has a tolerance of 1%. During manufacturing,the Rsense pull-up is enabled and the voltage at Rsense is measured withthe ADC. The 12-bit ADC value is written to the RSENSE location in NVM.This test duplicates that manufacture measurement. The Rsense pull-up isenabled and the ADC is used to measure the Rsense voltage. Themeasurement is compared to the one stored in NVM. The test fails if thetwo values differ by more than 5%. Otherwise, the test passes.

Battery Voltage Test

The Battery Voltage Test returns the state of the battery relative toseveral threshold values. The test measures the battery voltage usingthe ADC and compares it to the battery thresholds. The test reports thebattery is good if the voltage measurement is greater than 2.7 volts+/−5%. The test reports the battery is low if the voltage measurement isless than 2.7 volts +/−5% and greater than 2.3 volts +/−5%. The testreports the battery is depleted if the voltage measurement is less than2.3 volts +/−5%.

Analog Switch Validation Test

The Analog Switch Validation Test measures the voltage levels on boththe high and low sides of the dose button switch in order to detectpotential problems that could lead to erroneous switch readings. Undernormal conditions with the switch open, voltage on the high side of theswitch will be slightly less than battery voltage after accounting forthe small voltage drop caused by the electronic components connected tothe switch circuit. Under normal conditions, the voltage on the low sideof the switch will be very close to ground.

Some conditions, such as contamination or corrosion, can cause thehigh-side voltage to drop or the low-side voltage to rise. If thehigh-side voltage falls to less than (0.8×battery voltage), or thelow-side voltage rises to greater than (0.2×battery voltage), the switchinput is in a range of indeterminate digital logic level with respect tothe digital switch input. A switch voltage in this range could result inerroneous switch readings, which could manifest as false buttontransitions that were not initiated by the user. The Analog SwitchValidation Test detects the condition before the switch voltage levelsreach the point where erroneous readings could occur.

The Analog Switch Validation Test must run when the switch is in itsnormally-open condition so that the high- and low-side voltages can bothbe measured. Any change in the switch state while the test is runningcould cause the test to falsely fail due to measurement of the high-sidevoltage while the switch is closed. The user may press or release thebutton at any time, but there are mechanical and human limits on theminimum time between presses. Therefore, the point where the switchstate is known to be open with the greatest certainty is immediatelyfollowing a detected release of the button.

The Analog Switch Validation Test runs immediately following eachdetected button release. It uses the ITSIC ADC to make sequentialmeasurements of the high-side voltage, the low-side voltage, and thebattery voltage. The ADC is configured to sample for 6.25 ms for eachmeasurement. If the voltage on the high side of the switch is less thanor equal to (0.8×battery voltage), or if the voltage on the low side isgreater than or equal to (0.2×battery voltage), the test fails.

Digital Switch Validation Test

The Digital Switch Validation Test is similar in purpose to the AnalogSwitch Validation Test, but it may be simpler, faster, and coarser inits measurements.

The test uses secondary digital inputs, connected to each side of thedose button switch, to confirm the digital logic levels while the switchis open (button not depressed). The secondary digital inputs are of thesame type as the primary digital inputs, and the corresponding valuesare expected to match.

The Digital Switch Validation Test runs after the Analog SwitchValidation Test of the second button release of a double-press thatmeets the criteria for a dose initiation sequence. If the secondarydigital input on the high side of the switch is low, or if the secondarydigital input on the low side of the switch is high, the test fails.

Output Current Off Test

In some variations, the off-current module may be configured to performan Output Current Off Test. The Output Current Off Test may verify thatthe leakage current is less than some threshold (e.g., 3 μA, 9 μA, etc.)when the current source is off. The test may calculate the leakagecurrent from the measured Rsense voltage and the low-limit Rsenseresistance of 3.96 kOhms.

$I_{leakage} = \frac{V_{Rsense}}{R_{Rsense}}$V_(Rsense) = I_(leakage) * R_(Rsense) V_(Rsense) < (3  μA * 3.96  kOhms)V_(Rsense) < 12  mV

The test measures the Rsense voltage using the ADC while the currentsource is off. Thus, in some variations, if the Rsense voltagemeasurement is greater than some threshold (e.g., 12 mV, 36 mV, etc.)the test fails. Otherwise, the test passes.

Anode/Cathode Voltage Difference Test

In some variations the off-current module may also be configured toperform an Anode/Cathode Voltage Difference Test. The Anode/CathodeVoltage Difference Test may verify that when S1 is open and the currentsource is disabled, there is little voltage difference between the anodeand the cathode. This test may check for the failure case of currentflow from anode to cathode resulting from any fault in the outputcircuit. The test measures the anode voltage and the cathode voltageusing the ADC and calculates the voltage difference between the twopoints. The test fails if the voltage difference is greater than somethreshold (e.g., 0.85 V, 2.5 V, etc.). Otherwise, the test passes.

High Output Current Test

The High Output Current Test verifies that the dosing current is lessthan 187 μA. The test measures the voltage at Rsense using the ADC anduses that voltage to calculate the current.

$I_{dosing} = \frac{V_{Rsense}}{R_{Rsense}}$V_(Rsense) = I_(dosing) * R_(Rsense)R_(Rsense) < (187  μA * 3.96  kOhms) V_(Rsense) < 741  mV

An Rsense resistance at the low limit of 3.96 kOhms will result in thelowest measured Rsense voltage at 187 μA. The test fails if the measuredRsense voltage is greater than 741 mV. Otherwise, the test passes.

Poor Skin Contact Test

The Poor Skin-Contact Test verifies that the skin resistance is lessthan 432 kOhms +/−5%. The test measures the voltage at Rsense using theADC and uses that voltage to calculate the skin resistance.

$I_{dosing} = \frac{V_{Anode} - V_{Cathode}}{R_{Skin}}$$I_{dosing} = {\frac{9.25\mspace{14mu} V}{432\mspace{14mu}{kOhms}} = {21.4\mspace{14mu}{\mu A}}}$V_(Rsense) = I_(dosing) * R_(Rsense) V_(Rsense) > 21.4  μA * 3.96  kOhmsV_(Rsense) > 84.7  mV

At 432 kOhms, this example assumes that the difference between the anodeand the cathode is 9.25 V. Since the Rsense has a tolerance of 1%, 3.96kOhms is the lowest resistance it could have. The test fails if thevoltage at Rsense is less than 84.7 mV. Otherwise, the test passes.

Compromised Skin Barrier Test

The Compromised Skin Barrier Test verifies that the skin resistance isgreater than 5000 Ohms +/−5%. The test measures the cathode voltage andthe anode voltage using the ADC. The test uses these two measurements tocalculate the skin resistance.

$R_{Skin} = \frac{V_{Anode} - V_{Cathode}}{I_{dosing}}$V_(Anode) − V_(Cathode) = I_(dosing) * R_(Skin)(V_(Anode) − V_(Cathode)) > (170  μA * 5000  Ohms)(V_(Anode) − V_(Cathode)) > 0.85  V

The test fails if the difference between the anode voltage and thecathode voltage is less than 0.85 V. Otherwise, the test passes.

Drivers

The low-level hardware drivers provide functions to configure and usethe corresponding system hardware. The drivers do not maintain timinginformation. Modules that use the drivers must manage any necessarytiming. In some cases the drivers maintain state information pertainingto the hardware to which they provide an interface.

Timer

The Timer driver uses the hardware timers in the CPU to provide avariety of timing functions, including: (a) a system tick driven by aperiodic interrupt every 8 ms; (b) periodic ticks derived from thesystem tick and occurring every 50, 100, 250, 500, or 1000 ms; (c) asystem timer that counts the number of seconds since power was appliedto the system; (d) a dose timer that counts down the duration of a dose,in seconds; and (e) a button timer that counts down the time window fora button double-press for dose initiation.

The Timer driver uses hardware Timer0 as an 8-bit timer in auto-reloadmode to provide the 8-ms system tick. Timer0 generates an interrupt eachtime it rolls over. To minimize interrupt processing time, the interrupthandler simply increments an 8-bit counter, sets a local flag indicatingthat the system tick occurred, and samples the button input (see Section5.4.2 Dose Button). The driver provides a function for the main loop tocheck for occurrence of the tick. The 8-bit counter rolls over every2.048 seconds. This allows generation of periodic ticks with periods upto that value.

When the main loop sees that the system tick has occurred, it calls thetimer processing function, which updates software timers as appropriate.This function uses the system tick counter to decrement the dose and/orbutton timers once per second if they are active, and increment thesystem lifetime timer once per second. It also clears the system tickflag, indicating that processing is complete for that tick.

The Timer driver uses the system tick to calculate periodic ticks withperiods that are multiples of the system tick. Nominally the periodsavailable are 50, 100, 250, 500, or 1000 ms. However, not all theseperiods are integer multiples of 8 ms, so the exact period is less insome cases, due to truncation. The Timer driver provides functions tocheck for the occurrence of each periodic tick, as well as a function tosynchronize all periodic ticks to the current system tick value.

Dose Button

The Dose Button driver contains functions for sampling, debouncing, anddetecting transitions on the button input.

The button input is sampled every 8 ms in the Timer driver periodicinterrupt handler. This is necessary to achieve button sampling at aregular and sufficiently high rate. Execution of each iteration of themain loop spans several periodic interrupts and varies in duration withexecution path.

The button is sampled into a circular buffer that holds eight samples.The six most recent samples are used by the debounce algorithm todetermine the state of the button. All six samples must be the same toidentify a valid button state. If the buffer contains a mix of low andhigh sample values, the button is determined to be in a bouncing ortransition state. The Button driver keeps track of the state of thebutton from the previous time the debounce algorithm was applied and canthus identify transitions. A function is provided to check for a buttonrelease. It can be called approximately every 50 ms by tasks reading thebutton to provide acceptable user responsiveness to inputs. A releasetransition requires at least six samples with the button depressed,followed by at least six samples with it released. Thereforeapproximately 100 ms of sampling is required to identify a button press.

LCD

The LCD driver provides the software interface for displaying atwo-digit number on the LCD. The driver supports display of integers0-99. Input values 0-9 do not display a leading zero. The driver alsoexposes the LCD control functions: enable, disable, and blank

The left and right digits are designated Digit 1 and Digit 2respectively. Each of the two digits has seven segments. Segments arelabeled A-F, starting with the top segment and moving clockwise; thecenter segment is labeled G. The ITSIC may be capable of driving up to80 LCD segments. There are 20 segment control lines and 4 backplanelines (also called common lines) that are multiplexed to control each ofthe available 80 segments. In this application only 14 LCD segments areused with all 4 backplanes.

LED

The LED driver provides the software interface for controlling green andred LEDs. Fixed current settings are used to drive the LEDs according tothe device's power budget. The green LED is connected to the LED1current source and driven at 2.5 mA. The red LED is connected to theLED2 current source and driven at 1.4 mA. The driver uses the LED_BEEPregister to turn on, turn off or toggle each LED.

Beeper

The Beeper driver provides the software interface for controlling theaudio transducer. The operating frequency range is 1000-4875 Hz in 125Hz steps.

When turning on the audio transducer, the driver configures thetransducer to be driven by the voltage boost circuit. This allows forcontrol of the audio volume by adjustment of the boost voltage. However,the driver does not set voltage boost. The application is responsiblefor setting the appropriate boost level before enabling the transducer.Voltage boost can be configured using the Boost Controller driver.

The driver controls the audio transducer through the LED_BEEP andBEEP_FC registers.

Voltage Boost Controller

The Voltage Boost Controller driver provides the software interface forcontrolling the voltage boost block. This circuit is responsible forboosting battery voltage to the higher levels required to maintaindosing current output or drive the piezo audio transducer at sufficientvolume.

The driver supports boost levels over the full operating range: 0.0 to19.6875 volts in 0.3125 volt steps. The minimum boost voltage isdetermined by the battery voltage; settings below battery voltage resultin output equal to battery voltage. The boost circuit charge time isconfigurable in hardware but set to a fixed value of 1.5 microseconds ondriver initialization. Further, the driver provides functions forreading back the voltage control setting and enabling/disabling theboost circuit.

The driver provides a function to poll the boost over-voltage signal.The over-voltage signal is asserted if the voltage output exceeds 21.0volts. The driver controls the boost circuit through the BOOST_0,BOOST_1, EOV and IT1 registers.

Current Controller

The Current Controller driver provides the software interface forcontrolling the current source block. The current source output level iscontrolled by a 10-bit DAC. The driver allows for current output overthe full operating range of the current source. The driver controls thecurrent source through the ISRC_0, ISRC_1, EVL and IT0 registers.

The driver provides functions to enable or disable the current source,set the DAC value, read back the DAC value, and enable or disable theRsense pull-up resistor.

The driver also provides an interface to the current control block's lowvoltage signal (VLOW). During initialization this signal is configuredto monitor the gate voltage of M2. A function to monitor the state ofthe signal is provided.

Trimming

The current controller requires trimming to achieve the desired accuracyat 170 μA. The uncalibrated current controller has an accuracy of ±5%,while the calibrated current controller has an accuracy of ±0.5%. The10-bit DAC value to produce a current of 170 μA is determined andwritten to the ISRC_170 location in NVM during manufacture. This valueis read from NVM and written to the ISRC registers when the currentsource is enabled.

Analog to Digital Converter (ADC)

The ADC driver provides the software interface for configuring and usingthe ADC. The ADC has 12-bit resolution with three possible input ranges,configurable conversion time, and selectable inputs. The ADC inputs aregrouped by full-scale range: low (0.0 to 2.0 volts), medium (0.0 to 3.6volts) and high (0.0 to 24.0 volts).

The driver provides a function for configuring the input select,specifying the conversion time and starting a conversion. The conversiontime range is 0.78125 to 100 ms. The start-conversion function isnon-blocking and the conversion is asynchronous. Completion of theconversion is signaled by the ADC done interrupt. The driver isresponsible for handling this interrupt and storing the counts. Afunction is provided for the application to determine if an ADC read isin progress.

The ADC driver is responsible for applying calibration gain and offsetsfor the appropriate input range. The calibrations are applied when theapplication reads the result of a completed conversion. Calibrations arestored locally to the driver and a function is provided to return areference to the data structure. This reference is used to populate thecalibration values from NVM and to conduct the Calibration DataIntegrity Test.

The driver controls the ADC through the ADC_CTRL, ADC_MSB, ADC_LSB andEADC registers.

Trimming

The output of the ADC must be trimmed to achieve the desired accuracy.The output of the ADC has a gain error of ±5% and an offset error of±5%. After trimming, the ADC output has an accuracy of ±0.5%. Thetrimming calculation requires two 9-bit signed values from NVM for eachof the three ADC ranges. Each gain and offset is stored as an 8-bitunsigned value in NVM and there is a 6-bit value that holds all thesigned bits. Therefore, there are 7 values are written to NVM by themanufacture: ADC_GAIN_HIGH, ADC_OFFSET_HIGH, ADC_GAIN_MID,ADC_OFFSET_MID, ADC_GAIN_LOW, ADC_OFFSET_LOW, and ADC_SIGNS.

High  Range${ADC\_ result} = {{{ADC\_ out}*\left( {1 + \frac{{ADC\_ GAIN}{\_ HIGH}}{4096}} \right)} + {{ADC\_ OFFSET}{\_ HIGH}}}$ADC_result = (ADC_MSB<< 4)|(ADC_LSB>> 4);ADC_result+ = ((ADC_GAIN_HIGH * ADC_MSB)>> 8)&0 × FF;ADC_result+ = ADC_OFFSET_HIGH; Medium  Range${ADC\_ result} = {{{ADC\_ out}*\left( {1 + \frac{{ADC\_ GAIN}{\_ MID}}{4096}} \right)} + {{ADC\_ OFFSET}{\_ MID}}}$ADC_result = (ADC_MSB<< 4)|(ADC_LSB>> 4);ADC_result+ = ((ADC_GAIN_MID * ADC_MSB)>> 8)&0 × FF;ADC_result+ = ADC_OFFSET_MID; Low  Range${ADC\_ result} = {{{ADC\_ out}*\left( {1 + \frac{{ADC\_ GAIN}{\_ LOW}}{4096}} \right)} + {{ADC\_ OFFSET}{\_ LOW}}}$ADC_result = (ADC_MSB<< 4)|(ADC_LSB>> 4);ADC_result+ = ((ADC_GAIN_LOW * ADC_MSB)>> 8)&0 × FF;ADC_result+ = ADC_OFFSET_LOW;Watchdog

The Watchdog driver provides the software interface for initializing andservicing the watchdog. The watchdog timeout is configured to 6.144seconds by the initialization function. If the watchdog is not servicedwithin this period, the watchdog hardware resets the processor. Thewatchdog timer is started on driver initialization. The application isresponsible for servicing the watchdog.

ITSIC Core

The ITSIC Core driver provides the software interface for controllergeneral functions related to the ITSIC. These functions include:enabling and disabling all interrupts via the general enable bit, andreading and writing the oscillator calibration value. The driver usesthe EA and OSC_CAL registers. Upon initializing the driver theoscillator calibration is set to 0.0% with interrupts disabled.

Oscillator Calibration

The oscillator requires calibration to achieve ±1% accuracy in the 2.048MHz system clock. The uncalibrated oscillator has an accuracy of ±30%.The 8-bit calibration value adjusts the frequency of the oscillator andis determined and written to the OSC_CAL_VALUE location in NVM duringmanufacture. The OSC_CAL_VALUE is read from NVM and written directly tothe OSC_CAL register. After writing to the register, the oscillatorrequires a settling time of 1 mS.

Internal EEPROM

The ITSIC non-volatile memory is used by firmware for two purposes:persistent data storage and redundant storage of critical run-time data.The persistent storage includes device trimming data and the usage log.The redundant storage includes run-time data that has been identified ascritical to safety through risk analysis. The firmware is designed toread from and write from non-volatile memory.

The ITSIC non-volatile memory is an 8 k on-chip EEPROM organized as a128×64 bit array. EEPROM access is always an entire page (64 bits wide).The EEPROM is memory mapped and referenced from code via external dataaddressing. External data addresses are declared in code using the C51xdata keyword.

To improve reliability thus lowering the effective error rate, thefirmware applies error detection and correction mechanisms over theEEPROM. Three mechanisms are used, each with different integrityproperties. Hamming codes are used to encode entire pages. Hamming codesare used to encode specific data fields when entire page coding is notneeded. Finally parity bits are used to check integrity over data thatare not used by the device during operation. The two Hamming codes arecapable of correcting all 1-bit errors and detecting all 2-bit errors.Parity bits are capable of detecting any odd number of bit errors.

The software interface to the EEPROM may influence the design of thesystem, particularly data locality. Read access is transparent to thefirmware. The core reads the entire page into a 64 bit shadow register.If the requested page is already loaded, the EEPROM is not read at all.Write access requires the firmware to control the page commit timing. Awrite access first reads the corresponding EEPROM page into the shadowregister. When the firmware is ready to commit the page, it asserts apage clear for 1 ms, a page write for 1 ms and then resets both the pagewrite and clear bits.

Driver Structure

The EEPROM driver encapsulates access to the EEPROM by providingfunctions to read from and write to the EEPROM. The driver providesfunctions to decode and read data from the EEPROM. These functionsprovide access to the device's calibration values, boot parameters andthe device ID field.

The driver also provides function to validate the integrity of thesevalues after device initialization. The validation functions compare thevalue stored in RAM with the value stored in EEPROM to ensure that thecopy in RAM has not become corrupted.

Finally, the driver provides functions write to the EEPROM. Thesefunctions include usage logging and updating the device power-on-code.As needed the driver may handle Hamming encode and decode operations aswell as calculating parity bits on write-only fields.

The foregoing descriptions of specific embodiments of the presentinvention have been presented for purposes of illustration anddescription. They are not intended to be exhaustive or to limit theinvention to the precise forms disclosed, and obviously manymodifications and variations are possible in light of the aboveteaching. The embodiments were chosen and described in order to bestexplain the principles of the invention and its practical application,to thereby enable others skilled in the art to best utilize theinvention and various embodiments with various modifications as aresuited to the particular use contemplated. It is intended that the scopeof the invention be defined by the Claims appended hereto and theirequivalents.

What is claimed is:
 1. An electrotransport drug delivery device thatprevents unwanted delivery of drug while in an off state when the deviceis powered on, the device comprising: an anode and a cathode; anactivation circuit configured to apply current between the anode andcathode to deliver a drug by electrotransport when the device is in anon state and not in the off state; and wherein the device is configuredto shut down when there is a current flowing between the anode andcathode that is greater than an Output Current Off threshold when thedevice is in an off state while powered on; further wherein the deviceis configured to automatically and periodically determine if there is acurrent flowing between the anode and cathode when the activationcircuit is in the off state while powered on.
 2. The device of claim 1,wherein the device is configured to determine if there is a potentialdifference between the anode and the cathode when the activation circuitis in the off state while powered on.
 3. The device of claim 1, furtherconfigured to determine if there is a change in capacitance between theanode and cathode when the activation circuit is in the off state whilepowered on.
 4. The device of claim 1, further configured to determine ifthere is a change in inductance between the anode and cathode when theactivation circuit is in the off state while powered on.
 5. The deviceof claim 1, further comprising a sensing circuit that independentlydetermines an anode voltage and a cathode voltage and compares thepotential difference between the anode voltage and cathode voltage to athreshold value.
 6. The device of claim 5, further including a switchconnected between a reference voltage source and a sense resistor,further comprising an off-current module configured to close the switchperiodically to determine the potential difference between the anodevoltage and cathode voltage.
 7. The device of claim 1, furtherconfigured to determine if there is a current flowing between the anodeand cathode when the activation circuit is in the off state at leastonce per minute.
 8. The device of claim 1, further configured todetermine if there is a current flowing between the anode and cathodewhen the activation circuit is in the off state between at least onceevery 10 ms and once every 10 minutes.
 9. The device of claim 1, furtherconfigured to wait at least 10 ms before determining if there is acurrent flowing between the anode and cathode when the activationcircuit is in the off state.
 10. The device of claim 1, wherein thedevice has a two-part structure comprising: an electrical moduleincluding the activation circuit and an off-current module; and areservoir module including the anode and the cathode and a source ofdrug to be delivered, wherein the drug comprises fentanyl; wherein theelectrical module and reservoir module are configured to be combinedprior to application to a patient.
 11. The device of claim 1, furtherconfigured to indicate that there is a current flowing between the anodeand cathode when the activation circuit is in the off state whilepowered on where the current flowing is above the Output Current OffThreshold.
 12. The device of claim 1, wherein the Output Current OffThreshold is about 9 μA.
 13. The device of claim 1, further comprisingan Rsense resistor and an Rsense accuracy module configured to verifythe accuracy of an Rsense resistance value.
 14. The device of claim 1,further comprising an anode/cathode voltage difference test thatmeasures the anode voltage and the cathode voltage using the ADC andcalculates the voltage difference between the two.
 15. The device ofclaim 1, further comprising a reservoir module including the anode andthe cathode and a source of the drug to be delivered, wherein the drugcomprises fentanyl.
 16. A method of automatically and periodicallyconfirming that drug will not be delivered by an electrotransport drugdelivery device when the device is in an off state while powered on, themethod comprising: determining if there is a current flowing between ananode and a cathode of the electrotransport drug delivery device whenthe electrotransport drug delivery device is in an off state whilepowered on, wherein the electrotransport drug delivery device includesan activation circuit that is configured to apply current between theanode and the cathode to deliver a drug when the device is in an onstate and not deliver drug in the off state; and triggering an indicatorto indicate a leak current if there is a current flowing between theanode and cathode that is greater than an Output Current Off Thresholdwhen the electrotransport drug delivery device is in an off state whilepowered on, wherein triggering an indicator comprises one or more of: avisible notification, an audible notification, and a vibratorynotification; and performing a device shutdown when the indicator istriggered.
 17. The method of claim 16, further comprising repeating thedetermining step periodically while the activation circuit is in an offstate.
 18. The method of claim 16, further comprising repeating thedetermining step at least once every 10 minutes while the activationcircuit is in an off state and the device is powered on.
 19. The methodof claim 16, wherein the Output Current Off Threshold is about 9 μA. 20.The method of claim 16, wherein determining if there is a currentflowing between the anode and cathode of the electrotransport drugdelivery device comprises independently determining an anode voltage anda cathode voltage and comparing the potential difference between theanode voltage and cathode voltage to the threshold value.
 21. The methodof claim 16, wherein determining if there is a current flowing betweenthe anode and cathode of the electrotransport drug delivery devicecomprises independently connecting a reference voltage source and asense resistor with each of the anode and cathode to determine thepotential difference between the anode voltage and cathode voltage. 22.The method of claim 16, wherein triggering the indicator comprisesilluminating a light and/or sounding an alarm on the device.
 23. Themethod of claim 16, wherein determining comprises determining if thereis current flowing between the anode and the cathode of theelectrotransport drug delivery device when the electrotransport drugdelivery device is in the off state while powered on, wherein theelectrotransport drug delivery device includes an activation circuitthat is configured to apply current between the anode and the cathode todeliver fentanyl when the device is in the on state and not deliver drugin the off state.